Edit tour

Linux Analysis Report
I686.elf

Overview

General Information

Sample name:	I686.elf
Analysis ID:	1588953
MD5:	341269e2f627694b67c9d7abd07ed430
SHA1:	024ed60e6062fa2381bdc66ede172e0568c96b64
SHA256:	9c1f30e6fa0046e86606378ca020d487f0d50f1c25c04cff57a209debd760465
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588953
Start date and time:	2025-01-11 07:35:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	I686.elf
Detection:	MAL
Classification:	mal72.spre.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/I686.elf
PID:	6222
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Cia Qbot Has Infected This Device ;)
Standard Error:

Process Tree

system is lnxubuntu20

I686.elf (PID: 6222, Parent: 6138, MD5: 341269e2f627694b67c9d7abd07ed430) Arguments: /tmp/I686.elf

I686.elf New Fork (PID: 6223, Parent: 6222)

I686.elf New Fork (PID: 6224, Parent: 6222)

I686.elf New Fork (PID: 6225, Parent: 6224)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
I686.elf	Linux_Trojan_Mirai_e43a8744	unknown	unknown	0x6d07:$a: 23 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C

Memory Dumps

Source	Rule	Description	Author	Strings
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_83715433	unknown	unknown	0x12f7:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x538:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x11ce:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x120e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x92a:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x133a:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_83715433	unknown	unknown	0x12f7:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x538:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x11ce:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x120e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x92a:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x133a:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
6223.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_83715433	unknown	unknown	0x12f7:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
6223.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x538:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
6223.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x11ce:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
6223.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x120e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
6223.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x92a:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
6223.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x133a:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
Click to see the 13 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:35:58.266183+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40702	216.9.227.143	9198	TCP
2025-01-11T07:36:00.172056+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40704	216.9.227.143	9198	TCP
2025-01-11T07:36:01.972443+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40706	216.9.227.143	9198	TCP
2025-01-11T07:36:03.722007+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40708	216.9.227.143	9198	TCP
2025-01-11T07:36:05.503473+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40710	216.9.227.143	9198	TCP
2025-01-11T07:36:07.416220+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40712	216.9.227.143	9198	TCP
2025-01-11T07:36:09.149936+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40714	216.9.227.143	9198	TCP
2025-01-11T07:36:10.884682+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40716	216.9.227.143	9198	TCP
2025-01-11T07:36:12.640387+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40718	216.9.227.143	9198	TCP
2025-01-11T07:36:14.427987+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40720	216.9.227.143	9198	TCP
2025-01-11T07:36:16.188447+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40722	216.9.227.143	9198	TCP
2025-01-11T07:36:17.956253+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40724	216.9.227.143	9198	TCP
2025-01-11T07:36:19.698721+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40726	216.9.227.143	9198	TCP
2025-01-11T07:36:21.453014+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40728	216.9.227.143	9198	TCP
2025-01-11T07:36:23.181255+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40730	216.9.227.143	9198	TCP
2025-01-11T07:36:24.962064+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40732	216.9.227.143	9198	TCP
2025-01-11T07:36:26.699344+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40734	216.9.227.143	9198	TCP
2025-01-11T07:36:28.472456+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40736	216.9.227.143	9198	TCP
2025-01-11T07:36:30.254732+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40738	216.9.227.143	9198	TCP
2025-01-11T07:36:31.993724+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40740	216.9.227.143	9198	TCP
2025-01-11T07:36:33.775770+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40742	216.9.227.143	9198	TCP
2025-01-11T07:36:35.551608+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40744	216.9.227.143	9198	TCP
2025-01-11T07:36:37.295295+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40746	216.9.227.143	9198	TCP
2025-01-11T07:36:39.064387+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40748	216.9.227.143	9198	TCP
2025-01-11T07:36:40.850606+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40750	216.9.227.143	9198	TCP
2025-01-11T07:36:42.590925+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40752	216.9.227.143	9198	TCP
2025-01-11T07:36:44.361397+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40754	216.9.227.143	9198	TCP
2025-01-11T07:36:46.106463+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40756	216.9.227.143	9198	TCP
2025-01-11T07:36:47.873508+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40758	216.9.227.143	9198	TCP
2025-01-11T07:36:49.622199+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40760	216.9.227.143	9198	TCP
2025-01-11T07:36:51.411776+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40762	216.9.227.143	9198	TCP
2025-01-11T07:36:53.170368+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40764	216.9.227.143	9198	TCP
2025-01-11T07:36:54.922440+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40766	216.9.227.143	9198	TCP
2025-01-11T07:36:56.712672+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40768	216.9.227.143	9198	TCP
2025-01-11T07:36:58.490385+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40770	216.9.227.143	9198	TCP
2025-01-11T07:37:00.272950+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40772	216.9.227.143	9198	TCP
2025-01-11T07:37:02.034843+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40774	216.9.227.143	9198	TCP
2025-01-11T07:37:03.818176+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40776	216.9.227.143	9198	TCP
2025-01-11T07:37:05.581457+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40778	216.9.227.143	9198	TCP
2025-01-11T07:37:07.367653+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40780	216.9.227.143	9198	TCP
2025-01-11T07:37:09.129564+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40782	216.9.227.143	9198	TCP
2025-01-11T07:37:10.893734+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40784	216.9.227.143	9198	TCP
2025-01-11T07:37:12.681162+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40786	216.9.227.143	9198	TCP
2025-01-11T07:37:14.417077+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40788	216.9.227.143	9198	TCP
2025-01-11T07:37:16.172608+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40790	216.9.227.143	9198	TCP
2025-01-11T07:37:17.900302+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40792	216.9.227.143	9198	TCP
2025-01-11T07:37:19.640492+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40794	216.9.227.143	9198	TCP
2025-01-11T07:37:21.370434+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40796	216.9.227.143	9198	TCP
2025-01-11T07:37:23.126099+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40798	216.9.227.143	9198	TCP
2025-01-11T07:37:24.879667+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40800	216.9.227.143	9198	TCP
2025-01-11T07:37:26.627184+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40802	216.9.227.143	9198	TCP
2025-01-11T07:37:28.373413+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40804	216.9.227.143	9198	TCP
2025-01-11T07:37:30.126714+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40806	216.9.227.143	9198	TCP
2025-01-11T07:37:31.893745+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40808	216.9.227.143	9198	TCP
2025-01-11T07:37:33.639864+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40810	216.9.227.143	9198	TCP
2025-01-11T07:37:35.392857+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40812	216.9.227.143	9198	TCP
2025-01-11T07:37:37.135228+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40814	216.9.227.143	9198	TCP
2025-01-11T07:37:38.915025+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40816	216.9.227.143	9198	TCP
2025-01-11T07:37:40.676098+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40818	216.9.227.143	9198	TCP
2025-01-11T07:37:42.476563+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40820	216.9.227.143	9198	TCP
2025-01-11T07:37:44.257655+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40822	216.9.227.143	9198	TCP
2025-01-11T07:37:46.001346+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40824	216.9.227.143	9198	TCP
2025-01-11T07:38:24.162003+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40826	216.9.227.143	9198	TCP
2025-01-11T07:38:25.886409+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40828	216.9.227.143	9198	TCP
2025-01-11T07:38:27.647013+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40830	216.9.227.143	9198	TCP
2025-01-11T07:38:29.427146+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40832	216.9.227.143	9198	TCP
2025-01-11T07:38:31.213227+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40834	216.9.227.143	9198	TCP
2025-01-11T07:38:32.974248+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40836	216.9.227.143	9198	TCP
2025-01-11T07:38:34.759066+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40838	216.9.227.143	9198	TCP
2025-01-11T07:38:36.540867+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.23	40840	216.9.227.143	9198	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: I686.elf	Virustotal: Detection: 26%			Perma Link
Source: I686.elf	ReversingLabs: Detection: 23%

Machine Learning detection for sample

Source: I686.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/I686.elf (PID: 6222)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40706 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40752 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40708 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40716 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40742 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40728 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40738 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40704 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40826 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40740 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40818 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40736 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40762 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40732 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40820 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40722 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40724 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40734 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40710 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40754 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40718 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40806 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40810 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40760 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40726 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40788 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40834 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40748 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40778 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40764 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40774 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40746 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40712 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40784 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40792 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40790 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40730 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40766 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40768 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40800 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40772 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40840 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40758 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40702 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40780 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40822 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40794 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40796 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40838 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40804 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40828 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40836 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40750 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40770 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40830 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40802 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40756 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40824 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40744 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40798 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40714 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40816 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40776 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40832 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40720 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40786 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40782 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40814 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40808 -> 216.9.227.143:9198
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.23:40812 -> 216.9.227.143:9198

Source: global traffic

TCP traffic: 192.168.2.23:40702 -> 216.9.227.143:9198

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.9.227.143

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: I686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e43a8744 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown

Source: LOAD without section mappings

Program segment: 0x8048000

Source: I686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e43a8744 reference_sample = f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e7ead3d1a51f0d7435a6964293a45cb8fadd739afb23dc48c1d81fbc593b23ef, id = e43a8744-1c52-4f95-bd16-be6722bc4d1a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.spre.linELF@0/0@0/0

Source: I686.elf

Submission file: segment LOAD with 7.9542 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
I686.elf	27%	Virustotal	Browse
I686.elf	24%	ReversingLabs
I686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
216.9.227.143	unknown	Reserved	7018	ATT-INTERNET4US	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
216.9.227.143	X86_64.elf	Get hash	malicious	Unknown	Browse
	SPARC.elf	Get hash	malicious	Unknown	Browse
	X86_64.elf	Get hash	malicious	Unknown	Browse
	I686.elf	Get hash	malicious	Unknown	Browse
	M68K.elf	Get hash	malicious	Unknown	Browse
	I586.elf	Get hash	malicious	Unknown	Browse
	SH4.elf	Get hash	malicious	Unknown	Browse
	SPARC.elf	Get hash	malicious	Unknown	Browse
	SH4.elf	Get hash	malicious	Mirai	Browse
	POWERPC.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	ARMV5L.elf	Get hash	malicious	Unknown	Browse
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	SPARC.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	ARMV4L.elf	Get hash	malicious	Unknown	Browse
	MIPSEL.elf	Get hash	malicious	Unknown	Browse
	3.elf	Get hash	malicious	Unknown	Browse
	2.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ARMV5L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	SPARC.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ARMV4L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	MIPSEL.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	3.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	ARMV5L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.202.202.202
	SPARC.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ARMV4L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MIPSEL.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	3.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	2.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
ATT-INTERNET4US	X86_64.elf	Get hash	malicious	Unknown	Browse	216.9.227.143
	SPARC.elf	Get hash	malicious	Unknown	Browse	216.9.227.143
	6.elf	Get hash	malicious	Unknown	Browse	75.26.124.8
	4.elf	Get hash	malicious	Unknown	Browse	99.148.97.71
	3.elf	Get hash	malicious	Unknown	Browse	107.255.69.83
	4.elf	Get hash	malicious	Unknown	Browse	172.185.86.37
	6.elf	Get hash	malicious	Unknown	Browse	76.224.102.15
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	74.185.28.64
	frosty.spc.elf	Get hash	malicious	Mirai	Browse	172.125.131.84
	frosty.x86.elf	Get hash	malicious	Mirai	Browse	170.187.70.64

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.952060061404937
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	I686.elf
File size:	33'164 bytes
MD5:	341269e2f627694b67c9d7abd07ed430
SHA1:	024ed60e6062fa2381bdc66ede172e0568c96b64
SHA256:	9c1f30e6fa0046e86606378ca020d487f0d50f1c25c04cff57a209debd760465
SHA512:	085e39a53b1aaefc7f7d474fa5e2b3e9d210fcec35b48fae8e739fdee0440b653a6818636270f1a36ddbd32d89b5230fb7ee085ecb135bf8f92af2d5e0de228c
SSDEEP:	768:HyzmCa1b14OqUAldbIvqMVV0dw72ZM+S4KZs2RD0hXBwDU6nbcuyD7UryqM:SqJb140wsSMVad02M3R08U6nouy8mqM
TLSH:	A1E2E134C4F8AFD1C09D50FC351E6D0A52706B2696CA5332E7D8A47F8B26E9B795C213
File Content Preview:	.ELF....................@...4...........4. ...(.....................4...4...........................................Q.td.............................4.IYTS.....................Q..........?..k.I/.j....\.h.blz.x..&.A!!.1h\.?W'..o.....V.4Lk0..\|G.K....tmL.M..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x804ee40
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8048000	0x8048000	0x8034	0x8034	7.9542	0x5	R E	0x1000
LOAD	0x0	0x8051000	0x8051000	0x0	0xcb04	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:35:58.266183+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40702	216.9.227.143	9198	TCP
2025-01-11T07:36:00.172056+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40704	216.9.227.143	9198	TCP
2025-01-11T07:36:01.972443+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40706	216.9.227.143	9198	TCP
2025-01-11T07:36:03.722007+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40708	216.9.227.143	9198	TCP
2025-01-11T07:36:05.503473+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40710	216.9.227.143	9198	TCP
2025-01-11T07:36:07.416220+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40712	216.9.227.143	9198	TCP
2025-01-11T07:36:09.149936+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40714	216.9.227.143	9198	TCP
2025-01-11T07:36:10.884682+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40716	216.9.227.143	9198	TCP
2025-01-11T07:36:12.640387+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40718	216.9.227.143	9198	TCP
2025-01-11T07:36:14.427987+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40720	216.9.227.143	9198	TCP
2025-01-11T07:36:16.188447+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40722	216.9.227.143	9198	TCP
2025-01-11T07:36:17.956253+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40724	216.9.227.143	9198	TCP
2025-01-11T07:36:19.698721+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40726	216.9.227.143	9198	TCP
2025-01-11T07:36:21.453014+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40728	216.9.227.143	9198	TCP
2025-01-11T07:36:23.181255+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40730	216.9.227.143	9198	TCP
2025-01-11T07:36:24.962064+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40732	216.9.227.143	9198	TCP
2025-01-11T07:36:26.699344+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40734	216.9.227.143	9198	TCP
2025-01-11T07:36:28.472456+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40736	216.9.227.143	9198	TCP
2025-01-11T07:36:30.254732+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40738	216.9.227.143	9198	TCP
2025-01-11T07:36:31.993724+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40740	216.9.227.143	9198	TCP
2025-01-11T07:36:33.775770+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40742	216.9.227.143	9198	TCP
2025-01-11T07:36:35.551608+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40744	216.9.227.143	9198	TCP
2025-01-11T07:36:37.295295+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40746	216.9.227.143	9198	TCP
2025-01-11T07:36:39.064387+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40748	216.9.227.143	9198	TCP
2025-01-11T07:36:40.850606+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40750	216.9.227.143	9198	TCP
2025-01-11T07:36:42.590925+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40752	216.9.227.143	9198	TCP
2025-01-11T07:36:44.361397+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40754	216.9.227.143	9198	TCP
2025-01-11T07:36:46.106463+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40756	216.9.227.143	9198	TCP
2025-01-11T07:36:47.873508+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40758	216.9.227.143	9198	TCP
2025-01-11T07:36:49.622199+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40760	216.9.227.143	9198	TCP
2025-01-11T07:36:51.411776+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40762	216.9.227.143	9198	TCP
2025-01-11T07:36:53.170368+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40764	216.9.227.143	9198	TCP
2025-01-11T07:36:54.922440+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40766	216.9.227.143	9198	TCP
2025-01-11T07:36:56.712672+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40768	216.9.227.143	9198	TCP
2025-01-11T07:36:58.490385+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40770	216.9.227.143	9198	TCP
2025-01-11T07:37:00.272950+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40772	216.9.227.143	9198	TCP
2025-01-11T07:37:02.034843+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40774	216.9.227.143	9198	TCP
2025-01-11T07:37:03.818176+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40776	216.9.227.143	9198	TCP
2025-01-11T07:37:05.581457+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40778	216.9.227.143	9198	TCP
2025-01-11T07:37:07.367653+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40780	216.9.227.143	9198	TCP
2025-01-11T07:37:09.129564+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40782	216.9.227.143	9198	TCP
2025-01-11T07:37:10.893734+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40784	216.9.227.143	9198	TCP
2025-01-11T07:37:12.681162+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40786	216.9.227.143	9198	TCP
2025-01-11T07:37:14.417077+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40788	216.9.227.143	9198	TCP
2025-01-11T07:37:16.172608+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40790	216.9.227.143	9198	TCP
2025-01-11T07:37:17.900302+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40792	216.9.227.143	9198	TCP
2025-01-11T07:37:19.640492+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40794	216.9.227.143	9198	TCP
2025-01-11T07:37:21.370434+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40796	216.9.227.143	9198	TCP
2025-01-11T07:37:23.126099+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40798	216.9.227.143	9198	TCP
2025-01-11T07:37:24.879667+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40800	216.9.227.143	9198	TCP
2025-01-11T07:37:26.627184+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40802	216.9.227.143	9198	TCP
2025-01-11T07:37:28.373413+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40804	216.9.227.143	9198	TCP
2025-01-11T07:37:30.126714+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40806	216.9.227.143	9198	TCP
2025-01-11T07:37:31.893745+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40808	216.9.227.143	9198	TCP
2025-01-11T07:37:33.639864+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40810	216.9.227.143	9198	TCP
2025-01-11T07:37:35.392857+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40812	216.9.227.143	9198	TCP
2025-01-11T07:37:37.135228+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40814	216.9.227.143	9198	TCP
2025-01-11T07:37:38.915025+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40816	216.9.227.143	9198	TCP
2025-01-11T07:37:40.676098+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40818	216.9.227.143	9198	TCP
2025-01-11T07:37:42.476563+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40820	216.9.227.143	9198	TCP
2025-01-11T07:37:44.257655+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40822	216.9.227.143	9198	TCP
2025-01-11T07:37:46.001346+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40824	216.9.227.143	9198	TCP
2025-01-11T07:38:24.162003+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40826	216.9.227.143	9198	TCP
2025-01-11T07:38:25.886409+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40828	216.9.227.143	9198	TCP
2025-01-11T07:38:27.647013+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40830	216.9.227.143	9198	TCP
2025-01-11T07:38:29.427146+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40832	216.9.227.143	9198	TCP
2025-01-11T07:38:31.213227+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40834	216.9.227.143	9198	TCP
2025-01-11T07:38:32.974248+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40836	216.9.227.143	9198	TCP
2025-01-11T07:38:34.759066+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40838	216.9.227.143	9198	TCP
2025-01-11T07:38:36.540867+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.23	40840	216.9.227.143	9198	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:35:57.798818111 CET	40702	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:35:58.265947104 CET	9198	40702	216.9.227.143	192.168.2.23
Jan 11, 2025 07:35:58.266103983 CET	40702	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:35:58.266182899 CET	40702	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:35:58.274247885 CET	9198	40702	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:00.166084051 CET	9198	40702	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:00.166280031 CET	40702	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:00.166678905 CET	40704	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:00.171869993 CET	9198	40702	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:00.171905041 CET	9198	40704	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:00.172055960 CET	40704	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:00.172055960 CET	40704	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:00.176884890 CET	9198	40704	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:01.034734011 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 07:36:01.967153072 CET	9198	40704	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:01.967365026 CET	40704	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:01.967395067 CET	40706	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:01.972323895 CET	9198	40704	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:01.972357035 CET	9198	40706	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:01.972443104 CET	40706	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:01.972443104 CET	40706	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:01.977300882 CET	9198	40706	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:02.826608896 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 07:36:03.713011980 CET	9198	40706	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:03.713432074 CET	40708	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:03.713438988 CET	40706	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:03.721714020 CET	9198	40706	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:03.721884012 CET	9198	40708	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:03.721951962 CET	40708	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:03.722007036 CET	40708	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:03.728442907 CET	9198	40708	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:05.498085022 CET	9198	40708	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:05.498402119 CET	40708	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:05.498402119 CET	40710	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:05.503305912 CET	9198	40708	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:05.503371954 CET	9198	40710	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:05.503443003 CET	40710	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:05.503473043 CET	40710	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:05.508332968 CET	9198	40710	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:07.410744905 CET	9198	40710	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:07.410985947 CET	40710	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:07.411041975 CET	40712	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:07.416117907 CET	9198	40710	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:07.416138887 CET	9198	40712	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:07.416208982 CET	40712	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:07.416219950 CET	40712	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:07.420994997 CET	9198	40712	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:09.144495010 CET	9198	40712	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:09.145006895 CET	40712	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:09.145026922 CET	40714	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:09.149821043 CET	9198	40712	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:09.149835110 CET	9198	40714	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:09.149898052 CET	40714	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:09.149935961 CET	40714	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:09.154647112 CET	9198	40714	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:10.879359007 CET	9198	40714	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:10.879678965 CET	40714	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:10.879699945 CET	40716	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:10.884556055 CET	9198	40714	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:10.884567022 CET	9198	40716	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:10.884681940 CET	40716	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:10.884681940 CET	40716	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:10.889455080 CET	9198	40716	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:12.634757996 CET	9198	40716	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:12.635288954 CET	40716	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:12.635288954 CET	40718	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:12.640254974 CET	9198	40716	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:12.640268087 CET	9198	40718	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:12.640352011 CET	40718	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:12.640387058 CET	40718	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:12.645212889 CET	9198	40718	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:14.422764063 CET	9198	40718	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:14.422941923 CET	40718	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:14.422969103 CET	40720	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:14.427870035 CET	9198	40718	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:14.427903891 CET	9198	40720	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:14.427963972 CET	40720	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:14.427987099 CET	40720	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:14.432888985 CET	9198	40720	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:15.880733967 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 07:36:16.183336020 CET	9198	40720	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:16.183461905 CET	40720	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:16.183505058 CET	40722	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:16.188374996 CET	9198	40720	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:16.188388109 CET	9198	40722	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:16.188435078 CET	40722	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:16.188446999 CET	40722	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:16.193200111 CET	9198	40722	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:17.951035976 CET	9198	40722	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:17.951217890 CET	40722	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:17.951252937 CET	40724	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:17.956048012 CET	9198	40722	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:17.956152916 CET	9198	40724	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:17.956203938 CET	40724	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:17.956253052 CET	40724	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:17.960994959 CET	9198	40724	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:19.692385912 CET	9198	40724	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:19.692540884 CET	40724	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:19.692565918 CET	40726	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:19.698600054 CET	9198	40724	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:19.698649883 CET	9198	40726	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:19.698707104 CET	40726	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:19.698720932 CET	40726	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:19.704672098 CET	9198	40726	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:21.447500944 CET	9198	40726	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:21.447901964 CET	40726	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:21.448080063 CET	40728	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:21.452717066 CET	9198	40726	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:21.452897072 CET	9198	40728	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:21.452984095 CET	40728	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:21.453013897 CET	40728	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:21.457832098 CET	9198	40728	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:23.175864935 CET	9198	40728	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:23.176253080 CET	40728	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:23.176253080 CET	40730	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:23.181123972 CET	9198	40728	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:23.181142092 CET	9198	40730	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:23.181255102 CET	40730	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:23.181255102 CET	40730	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:23.186079025 CET	9198	40730	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:24.955804110 CET	9198	40730	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:24.956121922 CET	40732	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:24.956521988 CET	40730	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:24.961971045 CET	9198	40732	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:24.962033033 CET	40732	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:24.962064028 CET	40732	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:24.962136030 CET	9198	40730	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:24.967724085 CET	9198	40732	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:26.694048882 CET	9198	40732	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:26.694240093 CET	40732	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:26.694314957 CET	40734	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:26.699203014 CET	9198	40732	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:26.699237108 CET	9198	40734	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:26.699297905 CET	40734	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:26.699343920 CET	40734	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:26.704159021 CET	9198	40734	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:28.167011976 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 07:36:28.466993093 CET	9198	40734	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:28.467206955 CET	40734	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:28.467232943 CET	40736	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:28.472281933 CET	9198	40734	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:28.472317934 CET	9198	40736	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:28.472426891 CET	40736	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:28.472455978 CET	40736	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:28.477317095 CET	9198	40736	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:30.249147892 CET	9198	40736	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:30.249479055 CET	40736	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:30.249577045 CET	40738	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:30.254538059 CET	9198	40736	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:30.254592896 CET	9198	40738	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:30.254695892 CET	40738	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:30.254731894 CET	40738	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:30.259573936 CET	9198	40738	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:31.988650084 CET	9198	40738	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:31.988812923 CET	40738	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:31.988826990 CET	40740	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:31.993642092 CET	9198	40738	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:31.993658066 CET	9198	40740	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:31.993724108 CET	40740	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:31.993724108 CET	40740	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:31.998502016 CET	9198	40740	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:32.262450933 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 07:36:33.770699978 CET	9198	40740	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:33.770889044 CET	40740	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:33.770921946 CET	40742	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:33.775644064 CET	9198	40740	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:33.775695086 CET	9198	40742	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:33.775753975 CET	40742	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:33.775769949 CET	40742	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:33.780548096 CET	9198	40742	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:35.545159101 CET	9198	40742	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:35.545705080 CET	40744	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:35.545702934 CET	40742	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:35.551400900 CET	9198	40742	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:35.551414013 CET	9198	40744	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:35.551608086 CET	40744	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:35.551608086 CET	40744	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:35.557516098 CET	9198	40744	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:37.289910078 CET	9198	40744	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:37.290204048 CET	40744	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:37.290204048 CET	40746	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:37.295134068 CET	9198	40744	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:37.295169115 CET	9198	40746	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:37.295257092 CET	40746	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:37.295295000 CET	40746	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:37.300127029 CET	9198	40746	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:39.058971882 CET	9198	40746	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:39.059230089 CET	40746	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:39.059278011 CET	40748	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:39.064207077 CET	9198	40746	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:39.064240932 CET	9198	40748	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:39.064387083 CET	40748	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:39.064387083 CET	40748	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:39.069336891 CET	9198	40748	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:40.845098019 CET	9198	40748	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:40.845505953 CET	40748	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:40.845591068 CET	40750	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:40.850408077 CET	9198	40748	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:40.850464106 CET	9198	40750	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:40.850567102 CET	40750	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:40.850605965 CET	40750	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:40.855463982 CET	9198	40750	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:42.585417986 CET	9198	40750	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:42.585725069 CET	40750	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:42.585760117 CET	40752	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:42.590646982 CET	9198	40750	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:42.590660095 CET	9198	40752	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:42.590751886 CET	40752	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:42.590924978 CET	40752	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:42.595690966 CET	9198	40752	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:44.356302977 CET	9198	40752	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:44.356378078 CET	40752	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:44.356412888 CET	40754	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:44.361249924 CET	9198	40752	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:44.361270905 CET	9198	40754	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:44.361335039 CET	40754	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:44.361397028 CET	40754	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:44.366147995 CET	9198	40754	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:46.100980043 CET	9198	40754	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:46.101329088 CET	40754	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:46.101389885 CET	40756	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:46.106239080 CET	9198	40754	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:46.106333971 CET	9198	40756	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:46.106405020 CET	40756	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:46.106462955 CET	40756	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:46.111226082 CET	9198	40756	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:47.868241072 CET	9198	40756	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:47.868480921 CET	40756	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:47.868566990 CET	40758	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:47.873353004 CET	9198	40756	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:47.873368979 CET	9198	40758	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:47.873439074 CET	40758	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:47.873507977 CET	40758	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:47.878272057 CET	9198	40758	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:49.616924047 CET	9198	40758	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:49.617173910 CET	40758	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:49.617305994 CET	40760	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:49.622011900 CET	9198	40758	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:49.622029066 CET	9198	40760	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:49.622138977 CET	40760	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:49.622199059 CET	40760	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:49.629251003 CET	9198	40760	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:51.406685114 CET	9198	40760	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:51.406812906 CET	40760	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:51.406841040 CET	40762	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:51.411663055 CET	9198	40760	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:51.411674976 CET	9198	40762	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:51.411734104 CET	40762	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:51.411776066 CET	40762	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:51.416533947 CET	9198	40762	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:53.164340973 CET	9198	40762	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:53.164592028 CET	40762	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:53.164629936 CET	40764	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:53.170253992 CET	9198	40762	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:53.170300961 CET	9198	40764	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:53.170367956 CET	40764	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:53.170367956 CET	40764	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:53.175721884 CET	9198	40764	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:54.917176962 CET	9198	40764	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:54.917402029 CET	40764	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:54.917464018 CET	40766	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:54.922312975 CET	9198	40764	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:54.922327042 CET	9198	40766	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:54.922405958 CET	40766	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:54.922440052 CET	40766	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:54.927190065 CET	9198	40766	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:56.707202911 CET	9198	40766	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:56.707598925 CET	40766	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:56.707739115 CET	40768	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:56.712419033 CET	9198	40766	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:56.712536097 CET	9198	40768	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:56.712608099 CET	40768	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:56.712671995 CET	40768	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:56.717441082 CET	9198	40768	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:56.835092068 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 07:36:58.485131979 CET	9198	40768	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:58.485382080 CET	40768	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:58.485414982 CET	40770	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:58.490259886 CET	9198	40768	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:58.490273952 CET	9198	40770	216.9.227.143	192.168.2.23
Jan 11, 2025 07:36:58.490338087 CET	40770	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:58.490385056 CET	40770	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:36:58.495153904 CET	9198	40770	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:00.267779112 CET	9198	40770	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:00.267960072 CET	40770	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:00.267982006 CET	40772	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:00.272753954 CET	9198	40770	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:00.272883892 CET	9198	40772	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:00.272949934 CET	40772	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:00.272949934 CET	40772	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:00.277801037 CET	9198	40772	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:02.029562950 CET	9198	40772	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:02.029794931 CET	40772	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:02.029830933 CET	40774	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:02.034657955 CET	9198	40772	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:02.034694910 CET	9198	40774	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:02.034842968 CET	40774	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:02.034842968 CET	40774	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:02.039669991 CET	9198	40774	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:03.812717915 CET	9198	40774	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:03.812990904 CET	40774	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:03.813010931 CET	40776	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:03.818008900 CET	9198	40774	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:03.818027973 CET	9198	40776	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:03.818176031 CET	40776	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:03.818176031 CET	40776	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:03.823019028 CET	9198	40776	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:05.576215029 CET	9198	40776	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:05.576487064 CET	40776	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:05.576575041 CET	40778	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:05.581310987 CET	9198	40776	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:05.581355095 CET	9198	40778	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:05.581415892 CET	40778	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:05.581456900 CET	40778	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:05.586272955 CET	9198	40778	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:07.362227917 CET	9198	40778	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:07.362545967 CET	40778	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:07.362581968 CET	40780	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:07.367507935 CET	9198	40778	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:07.367542982 CET	9198	40780	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:07.367614985 CET	40780	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:07.367652893 CET	40780	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:07.372450113 CET	9198	40780	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:09.123385906 CET	9198	40780	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:09.123692989 CET	40780	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:09.123904943 CET	40782	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:09.129175901 CET	9198	40780	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:09.129451036 CET	9198	40782	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:09.129564047 CET	40782	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:09.129564047 CET	40782	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:09.134406090 CET	9198	40782	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:10.888310909 CET	9198	40782	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:10.888607979 CET	40782	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:10.888669014 CET	40784	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:10.893527985 CET	9198	40782	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:10.893614054 CET	9198	40784	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:10.893704891 CET	40784	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:10.893733978 CET	40784	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:10.898636103 CET	9198	40784	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:12.675909996 CET	9198	40784	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:12.676129103 CET	40784	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:12.676218987 CET	40786	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:12.681014061 CET	9198	40784	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:12.681030989 CET	9198	40786	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:12.681112051 CET	40786	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:12.681162119 CET	40786	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:12.685952902 CET	9198	40786	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:14.411643982 CET	9198	40786	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:14.411871910 CET	40786	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:14.411895990 CET	40788	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:14.416927099 CET	9198	40786	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:14.416963100 CET	9198	40788	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:14.417032003 CET	40788	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:14.417077065 CET	40788	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:14.421941996 CET	9198	40788	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:16.167165041 CET	9198	40788	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:16.167412996 CET	40788	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:16.167473078 CET	40790	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:16.172360897 CET	9198	40788	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:16.172458887 CET	9198	40790	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:16.172559977 CET	40790	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:16.172607899 CET	40790	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:16.177467108 CET	9198	40790	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:17.894948959 CET	9198	40790	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:17.895142078 CET	40790	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:17.895225048 CET	40792	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:17.899971008 CET	9198	40790	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:17.900216103 CET	9198	40792	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:17.900301933 CET	40792	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:17.900301933 CET	40792	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:17.905286074 CET	9198	40792	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:19.635046005 CET	9198	40792	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:19.635365009 CET	40792	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:19.635365009 CET	40794	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:19.640378952 CET	9198	40792	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:19.640413046 CET	9198	40794	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:19.640491962 CET	40794	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:19.640491962 CET	40794	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:19.645375967 CET	9198	40794	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:21.364979029 CET	9198	40794	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:21.365370035 CET	40796	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:21.365475893 CET	40794	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:21.370285988 CET	9198	40796	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:21.370372057 CET	40796	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:21.370434046 CET	40796	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:21.370438099 CET	9198	40794	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:21.375282049 CET	9198	40796	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:23.120929956 CET	9198	40796	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:23.121201992 CET	40796	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:23.121239901 CET	40798	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:23.126000881 CET	9198	40796	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:23.126024008 CET	9198	40798	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:23.126070023 CET	40798	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:23.126099110 CET	40798	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:23.130866051 CET	9198	40798	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:24.874104023 CET	9198	40798	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:24.874517918 CET	40798	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:24.874548912 CET	40800	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:24.879462004 CET	9198	40798	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:24.879478931 CET	9198	40800	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:24.879611969 CET	40800	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:24.879667044 CET	40800	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:24.884489059 CET	9198	40800	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:26.621778011 CET	9198	40800	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:26.622031927 CET	40800	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:26.622101068 CET	40802	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:26.626998901 CET	9198	40800	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:26.627018929 CET	9198	40802	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:26.627110958 CET	40802	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:26.627183914 CET	40802	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:26.631937981 CET	9198	40802	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:28.368165970 CET	9198	40802	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:28.368365049 CET	40802	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:28.368387938 CET	40804	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:28.373330116 CET	9198	40804	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:28.373342037 CET	9198	40802	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:28.373398066 CET	40804	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:28.373413086 CET	40804	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:28.378218889 CET	9198	40804	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:30.121632099 CET	9198	40804	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:30.121794939 CET	40804	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:30.121840954 CET	40806	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:30.126600027 CET	9198	40804	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:30.126612902 CET	9198	40806	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:30.126672029 CET	40806	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:30.126713991 CET	40806	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:30.131510973 CET	9198	40806	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:31.888279915 CET	9198	40806	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:31.888621092 CET	40806	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:31.888690948 CET	40808	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:31.893414974 CET	9198	40806	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:31.893580914 CET	9198	40808	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:31.893697977 CET	40808	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:31.893744946 CET	40808	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:31.898572922 CET	9198	40808	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:33.633793116 CET	9198	40808	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:33.634068966 CET	40808	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:33.634120941 CET	40810	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:33.638976097 CET	9198	40808	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:33.638988972 CET	9198	40810	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:33.639863014 CET	40810	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:33.639863968 CET	40810	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:33.644900084 CET	9198	40810	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:35.387309074 CET	9198	40810	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:35.387681007 CET	40810	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:35.387746096 CET	40812	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:35.392721891 CET	9198	40810	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:35.392744064 CET	9198	40812	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:35.392839909 CET	40812	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:35.392857075 CET	40812	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:35.397660971 CET	9198	40812	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:37.129894972 CET	9198	40812	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:37.130209923 CET	40812	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:37.130273104 CET	40814	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:37.135070086 CET	9198	40812	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:37.135113955 CET	9198	40814	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:37.135227919 CET	40814	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:37.135227919 CET	40814	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:37.140088081 CET	9198	40814	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:38.909724951 CET	9198	40814	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:38.909992933 CET	40814	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:38.910069942 CET	40816	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:38.914792061 CET	9198	40814	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:38.914871931 CET	9198	40816	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:38.914968014 CET	40816	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:38.915024996 CET	40816	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:38.919769049 CET	9198	40816	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:40.670773983 CET	9198	40816	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:40.670978069 CET	40816	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:40.671010017 CET	40818	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:40.675904036 CET	9198	40816	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:40.675967932 CET	9198	40818	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:40.676098108 CET	40818	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:40.676098108 CET	40818	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:40.680946112 CET	9198	40818	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:42.471129894 CET	9198	40818	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:42.471474886 CET	40818	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:42.471575975 CET	40820	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:42.476417065 CET	9198	40818	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:42.476440907 CET	9198	40820	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:42.476562977 CET	40820	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:42.476562977 CET	40820	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:42.481395006 CET	9198	40820	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:44.251250982 CET	9198	40820	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:44.251678944 CET	40820	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:44.251750946 CET	40822	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:44.257436037 CET	9198	40820	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:44.257543087 CET	9198	40822	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:44.257616043 CET	40822	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:44.257654905 CET	40822	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:44.263362885 CET	9198	40822	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:45.996161938 CET	9198	40822	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:45.996334076 CET	40822	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:45.996395111 CET	40824	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:46.001200914 CET	9198	40822	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:46.001214981 CET	9198	40824	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:46.001286983 CET	40824	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:46.001346111 CET	40824	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:46.006153107 CET	9198	40824	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:47.368108988 CET	9198	40824	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:47.368277073 CET	40824	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:37:47.536009073 CET	9198	40824	216.9.227.143	192.168.2.23
Jan 11, 2025 07:37:47.536128998 CET	40824	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:24.156461000 CET	9198	40824	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:24.156858921 CET	40824	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:24.156955004 CET	40826	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:24.161837101 CET	9198	40824	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:24.161851883 CET	9198	40826	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:24.161950111 CET	40826	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:24.162003040 CET	40826	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:24.166860104 CET	9198	40826	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:25.880700111 CET	9198	40826	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:25.881076097 CET	40826	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:25.881263018 CET	40828	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:25.886174917 CET	9198	40826	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:25.886279106 CET	9198	40828	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:25.886409044 CET	40828	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:25.886409044 CET	40828	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:25.891285896 CET	9198	40828	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:27.641876936 CET	9198	40828	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:27.642045021 CET	40828	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:27.642072916 CET	40830	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:27.646919012 CET	9198	40828	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:27.646930933 CET	9198	40830	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:27.646976948 CET	40830	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:27.647012949 CET	40830	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:27.651772022 CET	9198	40830	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:29.422028065 CET	9198	40830	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:29.422210932 CET	40830	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:29.422228098 CET	40832	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:29.427042007 CET	9198	40830	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:29.427054882 CET	9198	40832	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:29.427117109 CET	40832	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:29.427145958 CET	40832	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:29.431920052 CET	9198	40832	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:31.207879066 CET	9198	40832	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:31.208060026 CET	40832	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:31.208118916 CET	40834	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:31.213116884 CET	9198	40832	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:31.213154078 CET	9198	40834	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:31.213207960 CET	40834	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:31.213227034 CET	40834	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:31.218086958 CET	9198	40834	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:32.968978882 CET	9198	40834	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:32.969147921 CET	40834	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:32.969185114 CET	40836	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:32.974128962 CET	9198	40834	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:32.974153996 CET	9198	40836	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:32.974215984 CET	40836	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:32.974247932 CET	40836	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:32.979104042 CET	9198	40836	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:34.753901005 CET	9198	40836	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:34.754067898 CET	40836	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:34.754092932 CET	40838	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:34.758959055 CET	9198	40836	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:34.758982897 CET	9198	40838	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:34.759051085 CET	40838	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:34.759066105 CET	40838	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:34.763938904 CET	9198	40838	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:36.535528898 CET	9198	40838	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:36.535820961 CET	40838	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:36.535885096 CET	40840	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:36.540672064 CET	9198	40838	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:36.540745020 CET	9198	40840	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:36.540822029 CET	40840	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:36.540867090 CET	40840	9198	192.168.2.23	216.9.227.143
Jan 11, 2025 07:38:36.545638084 CET	9198	40840	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:46.106683016 CET	9198	40840	216.9.227.143	192.168.2.23
Jan 11, 2025 07:38:46.106851101 CET	40840	9198	192.168.2.23	216.9.227.143

System Behavior

Analysis Process: I686.elf PID: 6222, Parent PID: 6138

General

Start time (UTC):	06:35:56
Start date (UTC):	11/01/2025
Path:	/tmp/I686.elf
Arguments:	/tmp/I686.elf
File size:	33164 bytes
MD5 hash:	341269e2f627694b67c9d7abd07ed430

Chronological Activities

Analysis Process: I686.elf PID: 6223, Parent PID: 6222

General

Start time (UTC):	06:35:56
Start date (UTC):	11/01/2025
Path:	/tmp/I686.elf
Arguments:	-
File size:	33164 bytes
MD5 hash:	341269e2f627694b67c9d7abd07ed430

Chronological Activities

Analysis Process: I686.elf PID: 6224, Parent PID: 6222

General

Start time (UTC):	06:35:56
Start date (UTC):	11/01/2025
Path:	/tmp/I686.elf
Arguments:	-
File size:	33164 bytes
MD5 hash:	341269e2f627694b67c9d7abd07ed430

Chronological Activities

Analysis Process: I686.elf PID: 6225, Parent PID: 6224

General

Start time (UTC):	06:35:56
Start date (UTC):	11/01/2025
Path:	/tmp/I686.elf
Arguments:	-
File size:	33164 bytes
MD5 hash:	341269e2f627694b67c9d7abd07ed430

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report I686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: I686.elf PID: 6222, Parent PID: 6138

General

Chronological Activities

Analysis Process: I686.elf PID: 6223, Parent PID: 6222

General

Chronological Activities

Analysis Process: I686.elf PID: 6224, Parent PID: 6222

General

Chronological Activities

Analysis Process: I686.elf PID: 6225, Parent PID: 6224

General

Linux Analysis Report
I686.elf