Edit tour

Linux Analysis Report
Space.i686.elf

Overview

General Information

Sample name:	Space.i686.elf
Analysis ID:	1589128
MD5:	a6c1d7bc88a8a2a63e3aeda922848972
SHA1:	64cf9e8c5073186f4b32aab1db680110a8cf8b61
SHA256:	77890a55ee9bcccd58e84511cc0872580b941b6db70bcb850bfa5570f782ef6b
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589128
Start date and time:	2025-01-11 10:45:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.i686.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.i686.elf
PID:	6267
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6245, Parent: 4331)

rm (PID: 6245, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZJ32nmcMaW /tmp/tmp.L3KT3rEF10 /tmp/tmp.xVjHuqvBSS

dash New Fork (PID: 6246, Parent: 4331)

cat (PID: 6246, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ZJ32nmcMaW

dash New Fork (PID: 6247, Parent: 4331)

head (PID: 6247, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6248, Parent: 4331)

tr (PID: 6248, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6249, Parent: 4331)

cut (PID: 6249, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6250, Parent: 4331)

cat (PID: 6250, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ZJ32nmcMaW

dash New Fork (PID: 6251, Parent: 4331)

head (PID: 6251, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6252, Parent: 4331)

tr (PID: 6252, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6253, Parent: 4331)

cut (PID: 6253, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6254, Parent: 4331)

rm (PID: 6254, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZJ32nmcMaW /tmp/tmp.L3KT3rEF10 /tmp/tmp.xVjHuqvBSS

Space.i686.elf (PID: 6267, Parent: 6180, MD5: a6c1d7bc88a8a2a63e3aeda922848972) Arguments: /tmp/Space.i686.elf

Space.i686.elf New Fork (PID: 6268, Parent: 6267)

Space.i686.elf New Fork (PID: 6269, Parent: 6268)

Space.i686.elf New Fork (PID: 6270, Parent: 6268)

Space.i686.elf New Fork (PID: 6273, Parent: 6267)

Space.i686.elf New Fork (PID: 6274, Parent: 6267)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6269.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6269.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6269.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6273.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6273.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6273.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6268.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6268.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6268.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6267.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x115f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6267.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x9ccb:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6267.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x84ae:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
Process Memory Space: Space.i686.elf PID: 6267	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x45d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x471:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x485:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x499:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x511:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x525:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x539:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x561:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x575:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x589:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x59d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 6268	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xbf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 6269	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x735:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x749:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x771:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x785:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x799:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x811:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x825:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x839:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x861:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x875:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x889:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 6273	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1711:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1739:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1761:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1775:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1789:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x179d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1801:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x183d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1879:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.i686.elf	Virustotal: Detection: 44%			Perma Link
Source: Space.i686.elf	ReversingLabs: Detection: 57%

Machine Learning detection for sample

Source: Space.i686.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:38532 -> 212.81.47.243:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243

Source: Space.i686.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6269.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6269.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6269.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6273.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6273.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6273.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6268.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6268.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6268.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6267.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6267.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6267.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6268, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 6273, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6269.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6269.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6269.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6273.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6268.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6268.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6268.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6267.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6267.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6267.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: Process Memory Space: Space.i686.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 6268, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 6273, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/5816/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/6238/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/6239/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/4507/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/4502/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 6267)	File opened: /proc/6267/status	Jump to behavior

Source: /usr/bin/dash (PID: 6245)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZJ32nmcMaW /tmp/tmp.L3KT3rEF10 /tmp/tmp.xVjHuqvBSS			Jump to behavior
Source: /usr/bin/dash (PID: 6254)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZJ32nmcMaW /tmp/tmp.L3KT3rEF10 /tmp/tmp.xVjHuqvBSS			Jump to behavior

Source: Space.i686.elf

Submission file: segment LOAD with 7.9632 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.i686.elf	44%	Virustotal		Browse
Space.i686.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
Space.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.i686.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
212.81.47.243	unknown	Germany	9009	M247GB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
212.81.47.243	Space.sh4.elf	Get hash	malicious	Unknown	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	Space.mpsl.elf	Get hash	malicious	Unknown	Browse
	Space.arm6.elf	Get hash	malicious	Unknown	Browse
	Space.ppc.elf	Get hash	malicious	Unknown	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	Space.arm7.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	Space.arm7.elf	Get hash	malicious	Mirai	Browse
	ARMV7L.elf	Get hash	malicious	Unknown	Browse
	MIPS.elf	Get hash	malicious	Unknown	Browse
	SH4.elf	Get hash	malicious	Unknown	Browse
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	I586.elf	Get hash	malicious	Unknown	Browse
	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Space.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	MIPS.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SH4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	I586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssc.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
CANONICAL-ASGB	Space.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	MIPS.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SH4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	I586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssc.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
INIT7CH	Space.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MIPS.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SH4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.202.202.202
	I586.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ssl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	sst.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
M247GB	Space.sh4.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.mips.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	212.81.47.243
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	212.81.47.243
	Space.x86.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	ssd.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.961371552446028
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.i686.elf
File size:	38'296 bytes
MD5:	a6c1d7bc88a8a2a63e3aeda922848972
SHA1:	64cf9e8c5073186f4b32aab1db680110a8cf8b61
SHA256:	77890a55ee9bcccd58e84511cc0872580b941b6db70bcb850bfa5570f782ef6b
SHA512:	51d038155979b53b998630cc142073922e834249cbc3261e05324a4c31df006a786aa80b5994611cc2e85c817efefbb57fac70748f790f749dfd48c15a86a359
SSDEEP:	768:+wtA4ekApSSGy1ITyzAv+tTmoTu5Jbb+Y88mViJlHGq3nbcuyD7UHQRjN:+wtAAA7DAWlTWJe7eJlmq3nouy8HyB
TLSH:	9803F250C0765B08C1DE90794CFAB68FD9A0B00D68683BFBA38AB97D8D73F1A5E0414C
File Content Preview:	.ELF........................4...........4. ...(.....................................................................Q.td.............................-[.UPX!.........B...B......W..........?..k.I/.j....\.W'"....)....4go.\|.>#.....{~vx...A.Zg..3~........2..R.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc092a8
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x949c	0x949c	7.9632	0x5	R E	0x1000
LOAD	0xc08	0x805cc08	0x805cc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 10:46:43.154709101 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 10:46:44.564033985 CET	38532	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:44.569277048 CET	3778	38532	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:44.569336891 CET	38532	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:44.569379091 CET	38532	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:44.574281931 CET	3778	38532	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:44.574345112 CET	38532	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:44.579235077 CET	3778	38532	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:45.465210915 CET	3778	38532	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:45.465370893 CET	38532	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:45.465372086 CET	38532	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:45.465372086 CET	38534	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:45.470379114 CET	3778	38534	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:45.470463037 CET	38534	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:45.470463037 CET	38534	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:45.475332975 CET	3778	38534	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:45.475424051 CET	38534	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:45.480274916 CET	3778	38534	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:45.970185041 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 10:46:46.417252064 CET	3778	38534	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:46.417583942 CET	38534	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:46.417584896 CET	38534	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:46.417597055 CET	38536	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:46.422625065 CET	3778	38536	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:46.422688961 CET	38536	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:46.422727108 CET	38536	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:46.427628040 CET	3778	38536	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:46.427687883 CET	38536	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:46.432571888 CET	3778	38536	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:47.325903893 CET	3778	38536	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:47.326212883 CET	38538	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:47.326214075 CET	38536	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:47.326214075 CET	38536	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:47.331100941 CET	3778	38538	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:47.331285000 CET	38538	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:47.331285000 CET	38538	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:47.336163998 CET	3778	38538	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:47.336209059 CET	38538	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:47.341053963 CET	3778	38538	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:48.223561049 CET	3778	38538	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:48.223716021 CET	38538	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:48.223772049 CET	38538	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:48.223912954 CET	38540	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:48.228874922 CET	3778	38540	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:48.229038000 CET	38540	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:48.229038000 CET	38540	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:48.234014034 CET	3778	38540	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:48.234071016 CET	38540	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:48.238910913 CET	3778	38540	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:48.785968065 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 10:46:49.148972034 CET	3778	38540	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:49.149215937 CET	38540	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:49.149215937 CET	38540	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:49.149215937 CET	38542	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:49.154217005 CET	3778	38542	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:49.154278040 CET	38542	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:49.154316902 CET	38542	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:49.159212112 CET	3778	38542	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:49.159262896 CET	38542	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:49.164128065 CET	3778	38542	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.045902014 CET	3778	38542	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.046125889 CET	38542	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.046127081 CET	38542	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.046205997 CET	38544	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.051086903 CET	3778	38544	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.051175117 CET	38544	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.051199913 CET	38544	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.056047916 CET	3778	38544	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.056104898 CET	38544	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.060935020 CET	3778	38544	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.352390051 CET	38546	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.357466936 CET	3778	38546	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.357534885 CET	38546	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.357575893 CET	38546	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.362499952 CET	3778	38546	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.362550020 CET	38546	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.367410898 CET	3778	38546	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.955569983 CET	3778	38544	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.955934048 CET	38548	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.955940008 CET	38544	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.955940008 CET	38544	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.960906982 CET	3778	38548	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.960973978 CET	38548	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.961014986 CET	38548	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.965889931 CET	3778	38548	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:50.965946913 CET	38548	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:50.970841885 CET	3778	38548	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.250420094 CET	3778	38546	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.250653982 CET	38546	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.250654936 CET	38550	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.250653982 CET	38546	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.255618095 CET	3778	38550	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.255800009 CET	38550	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.255845070 CET	38550	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.260710955 CET	3778	38550	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.260766983 CET	38550	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.265698910 CET	3778	38550	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.852338076 CET	3778	38548	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.852653027 CET	38548	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.852653027 CET	38548	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.852654934 CET	38552	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.857666016 CET	3778	38552	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.857748985 CET	38552	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.857748985 CET	38552	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.862658978 CET	3778	38552	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:51.862713099 CET	38552	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:51.867616892 CET	3778	38552	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.148158073 CET	3778	38550	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.148485899 CET	38550	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.148485899 CET	38550	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.148514986 CET	38554	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.153436899 CET	3778	38554	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.153498888 CET	38554	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.153543949 CET	38554	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.158490896 CET	3778	38554	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.158552885 CET	38554	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.163530111 CET	3778	38554	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.774297953 CET	3778	38552	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.774568081 CET	38552	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.774652958 CET	38556	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.774682045 CET	38552	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.779613972 CET	3778	38556	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.779694080 CET	38556	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.779733896 CET	38556	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.784545898 CET	3778	38556	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:52.784607887 CET	38556	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:52.789463043 CET	3778	38556	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.063851118 CET	3778	38554	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.064049959 CET	38554	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.064049959 CET	38554	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.064096928 CET	38558	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.068928003 CET	3778	38558	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.068996906 CET	38558	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.069036007 CET	38558	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.073796034 CET	3778	38558	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.073848009 CET	38558	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.078653097 CET	3778	38558	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.710076094 CET	3778	38556	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.710489035 CET	38556	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.710489035 CET	38556	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.710510015 CET	38560	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.715455055 CET	3778	38560	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.715529919 CET	38560	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.715565920 CET	38560	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.720421076 CET	3778	38560	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.720568895 CET	38560	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.725493908 CET	3778	38560	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.965107918 CET	3778	38558	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.965357065 CET	38558	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.965411901 CET	38558	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.965437889 CET	38562	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.971379995 CET	3778	38562	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.971472979 CET	38562	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.971509933 CET	38562	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.977459908 CET	3778	38562	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:53.977516890 CET	38562	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:53.983370066 CET	3778	38562	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.638581991 CET	3778	38560	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.638998985 CET	38564	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.639000893 CET	38560	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.639000893 CET	38560	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.643929958 CET	3778	38564	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.643995047 CET	38564	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.644021034 CET	38564	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.648804903 CET	3778	38564	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.648858070 CET	38564	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.653752089 CET	3778	38564	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.867311001 CET	3778	38562	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.867525101 CET	38562	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.867525101 CET	38562	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.867600918 CET	38566	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.872481108 CET	3778	38566	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.872554064 CET	38566	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.872576952 CET	38566	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.877458096 CET	3778	38566	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:54.877510071 CET	38566	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:54.882292986 CET	3778	38566	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.538441896 CET	3778	38564	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.538937092 CET	38564	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.538938046 CET	38564	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.538999081 CET	38568	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.543945074 CET	3778	38568	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.544059038 CET	38568	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.544137955 CET	38568	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.549429893 CET	3778	38568	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.549515009 CET	38568	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.554478884 CET	3778	38568	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.762326956 CET	3778	38566	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.762598991 CET	38566	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.762599945 CET	38566	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.762676954 CET	38570	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.767575979 CET	3778	38570	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.767668962 CET	38570	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.767729998 CET	38570	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.772562027 CET	3778	38570	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:55.772655010 CET	38570	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:55.777509928 CET	3778	38570	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.447261095 CET	3778	38568	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.447773933 CET	38568	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.447781086 CET	38572	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.447773933 CET	38568	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.452658892 CET	3778	38572	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.452737093 CET	38572	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.452805996 CET	38572	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.457557917 CET	3778	38572	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.457617998 CET	38572	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.462413073 CET	3778	38572	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.659956932 CET	3778	38570	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.660211086 CET	38574	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.660223007 CET	38570	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.660223007 CET	38570	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.665108919 CET	3778	38574	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.665199041 CET	38574	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.665246964 CET	38574	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.670067072 CET	3778	38574	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:56.670130968 CET	38574	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:56.674927950 CET	3778	38574	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.363004923 CET	3778	38572	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.363346100 CET	38572	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.363346100 CET	38572	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.363369942 CET	38576	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.368263006 CET	3778	38576	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.368376970 CET	38576	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.368432045 CET	38576	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.373178959 CET	3778	38576	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.373250961 CET	38576	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.378067017 CET	3778	38576	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.580979109 CET	3778	38574	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.581218958 CET	38574	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.581218958 CET	38574	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.581223011 CET	38578	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.586113930 CET	3778	38578	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.586163044 CET	38578	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.586184978 CET	38578	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.590934038 CET	3778	38578	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:57.590974092 CET	38578	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:57.595808983 CET	3778	38578	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.265017986 CET	3778	38576	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.265352964 CET	38580	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.265357971 CET	38576	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.265358925 CET	38576	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.270311117 CET	3778	38580	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.270499945 CET	38580	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.270499945 CET	38580	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.275374889 CET	3778	38580	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.275453091 CET	38580	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.280334949 CET	3778	38580	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.514049053 CET	3778	38578	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.514393091 CET	38578	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.514393091 CET	38578	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.514591932 CET	38582	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.519714117 CET	3778	38582	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.519829035 CET	38582	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.519876957 CET	38582	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.524682999 CET	3778	38582	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:58.524758101 CET	38582	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:58.529617071 CET	3778	38582	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.185323000 CET	3778	38580	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.185731888 CET	38584	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.185828924 CET	38580	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.185828924 CET	38580	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.191371918 CET	3778	38584	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.191485882 CET	38584	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.191587925 CET	38584	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.196588993 CET	3778	38584	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.196666956 CET	38584	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.202672005 CET	3778	38584	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.421365023 CET	3778	38582	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.421606064 CET	38582	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.421606064 CET	38582	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.421664953 CET	38586	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.426528931 CET	3778	38586	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.426635027 CET	38586	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.426686049 CET	38586	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.431514025 CET	3778	38586	212.81.47.243	192.168.2.23
Jan 11, 2025 10:46:59.431577921 CET	38586	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:46:59.436445951 CET	3778	38586	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.109724045 CET	3778	38584	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.110022068 CET	38584	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.110023022 CET	38584	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.110074997 CET	38588	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.114964962 CET	3778	38588	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.115066051 CET	38588	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.115108967 CET	38588	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.120035887 CET	3778	38588	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.120112896 CET	38588	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.124969959 CET	3778	38588	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.337165117 CET	3778	38586	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.337366104 CET	38586	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.337420940 CET	38586	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.337502003 CET	38590	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.342433929 CET	3778	38590	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.342525959 CET	38590	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.342598915 CET	38590	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.347471952 CET	3778	38590	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:00.347601891 CET	38590	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:00.352459908 CET	3778	38590	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.022058010 CET	3778	38588	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.022301912 CET	38588	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.022375107 CET	38588	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.022480965 CET	38592	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.027291059 CET	3778	38592	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.027364969 CET	38592	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.027390003 CET	38592	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.032227993 CET	3778	38592	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.032284975 CET	38592	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.037174940 CET	3778	38592	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.239234924 CET	3778	38590	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.239422083 CET	38590	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.239502907 CET	38590	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.239680052 CET	38594	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.244477987 CET	3778	38594	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.244558096 CET	38594	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.244618893 CET	38594	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.249439955 CET	3778	38594	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.249497890 CET	38594	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.254338980 CET	3778	38594	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.929986000 CET	3778	38592	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.930305958 CET	38592	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.930305958 CET	38592	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.930380106 CET	38596	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.935497046 CET	3778	38596	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.935605049 CET	38596	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.935687065 CET	38596	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.940471888 CET	3778	38596	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:01.940597057 CET	38596	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:01.945415974 CET	3778	38596	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.157908916 CET	3778	38594	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.158126116 CET	38598	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.158207893 CET	38594	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.158207893 CET	38594	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.163002968 CET	3778	38598	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.163065910 CET	38598	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.163268089 CET	38598	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.168112993 CET	3778	38598	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.168215036 CET	38598	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.173033953 CET	3778	38598	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.849119902 CET	3778	38596	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.849415064 CET	38596	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.849493980 CET	38596	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.849584103 CET	38600	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.854463100 CET	3778	38600	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.854562044 CET	38600	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.854604006 CET	38600	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.859381914 CET	3778	38600	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:02.859452009 CET	38600	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:02.864303112 CET	3778	38600	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.055211067 CET	3778	38598	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.055680037 CET	38598	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.055715084 CET	38602	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.055774927 CET	38598	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.060836077 CET	3778	38602	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.060930967 CET	38602	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.060992002 CET	38602	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.066570997 CET	3778	38602	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.066647053 CET	38602	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.071962118 CET	3778	38602	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.631809950 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 10:47:03.768414021 CET	3778	38600	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.768749952 CET	38600	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.768749952 CET	38600	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.768790960 CET	38604	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.773765087 CET	3778	38604	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.773848057 CET	38604	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.773927927 CET	38604	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.778742075 CET	3778	38604	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.778815985 CET	38604	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.783674955 CET	3778	38604	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.954035997 CET	3778	38602	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.954232931 CET	38602	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.954313993 CET	38602	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.954335928 CET	38606	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.959197998 CET	3778	38606	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.959292889 CET	38606	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.959347010 CET	38606	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.964121103 CET	3778	38606	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:03.964196920 CET	38606	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:03.969074011 CET	3778	38606	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.679810047 CET	3778	38604	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.680121899 CET	38604	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.680123091 CET	38604	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.680147886 CET	38608	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.685127020 CET	3778	38608	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.685254097 CET	38608	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.685293913 CET	38608	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.690088034 CET	3778	38608	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.690181971 CET	38608	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.695086002 CET	3778	38608	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.879545927 CET	3778	38606	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.879821062 CET	38610	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.879898071 CET	38606	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.879898071 CET	38606	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.884738922 CET	3778	38610	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.884814978 CET	38610	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.884865046 CET	38610	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.889662027 CET	3778	38610	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:04.889729023 CET	38610	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:04.894627094 CET	3778	38610	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.613203049 CET	3778	38608	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.613486052 CET	38612	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.613526106 CET	38608	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.613526106 CET	38608	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.618356943 CET	3778	38612	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.618464947 CET	38612	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.618500948 CET	38612	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.623254061 CET	3778	38612	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.623323917 CET	38612	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.628144026 CET	3778	38612	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.833050013 CET	3778	38610	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.833275080 CET	38610	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.833338976 CET	38614	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.833370924 CET	38610	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.840091944 CET	3778	38614	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.840167999 CET	38614	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.840240955 CET	38614	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.845230103 CET	3778	38614	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:05.845293045 CET	38614	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:05.850181103 CET	3778	38614	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.533256054 CET	3778	38612	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.533413887 CET	38612	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.533596039 CET	38612	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.533704996 CET	38616	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.538628101 CET	3778	38616	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.538786888 CET	38616	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.538842916 CET	38616	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.543665886 CET	3778	38616	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.543776989 CET	38616	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.548607111 CET	3778	38616	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.747752905 CET	3778	38614	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.747978926 CET	38614	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.747978926 CET	38614	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.748033047 CET	38618	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.752944946 CET	3778	38618	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.753021955 CET	38618	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.753086090 CET	38618	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.757859945 CET	3778	38618	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:06.757972956 CET	38618	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:06.762759924 CET	3778	38618	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.431785107 CET	3778	38616	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.432025909 CET	38616	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.432159901 CET	38616	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.432244062 CET	38620	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.437159061 CET	3778	38620	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.437244892 CET	38620	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.437294960 CET	38620	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.442107916 CET	3778	38620	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.442172050 CET	38620	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.447004080 CET	3778	38620	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.667617083 CET	3778	38618	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.667819977 CET	38618	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.667820930 CET	38618	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.667892933 CET	38622	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.672851086 CET	3778	38622	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.672923088 CET	38622	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.672965050 CET	38622	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.677783966 CET	3778	38622	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:07.677849054 CET	38622	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:07.682763100 CET	3778	38622	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.337069988 CET	3778	38620	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.337253094 CET	38620	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.337320089 CET	38620	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.337446928 CET	38624	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.342356920 CET	3778	38624	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.342454910 CET	38624	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.342526913 CET	38624	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.347328901 CET	3778	38624	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.347454071 CET	38624	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.352236032 CET	3778	38624	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.615071058 CET	3778	38622	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.615334988 CET	38622	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.615334034 CET	38626	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.615334988 CET	38622	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.620282888 CET	3778	38626	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.620431900 CET	38626	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.620455980 CET	38626	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.625298977 CET	3778	38626	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:08.625370026 CET	38626	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:08.630177021 CET	3778	38626	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.243680954 CET	3778	38624	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.244213104 CET	38628	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.244324923 CET	38624	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.244324923 CET	38624	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.249341965 CET	3778	38628	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.249409914 CET	38628	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.249450922 CET	38628	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.254287958 CET	3778	38628	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.254352093 CET	38628	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.259160042 CET	3778	38628	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.527878046 CET	3778	38626	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.528182030 CET	38630	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.528225899 CET	38626	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.528227091 CET	38626	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.533070087 CET	3778	38630	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.533193111 CET	38630	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.533229113 CET	38630	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.538017988 CET	3778	38630	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:09.538099051 CET	38630	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:09.542939901 CET	3778	38630	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.169691086 CET	3778	38628	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.170001030 CET	38628	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.170072079 CET	38628	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.170206070 CET	38632	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.175142050 CET	3778	38632	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.175242901 CET	38632	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.175298929 CET	38632	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.180144072 CET	3778	38632	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.180277109 CET	38632	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.185131073 CET	3778	38632	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.448312998 CET	3778	38630	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.448529005 CET	38630	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.448570967 CET	38630	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.448648930 CET	38634	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.453576088 CET	3778	38634	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.453684092 CET	38634	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.453738928 CET	38634	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.458605051 CET	3778	38634	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:10.458698034 CET	38634	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:10.463551044 CET	3778	38634	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.113187075 CET	3778	38632	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.113496065 CET	38632	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.113595009 CET	38632	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.113663912 CET	38636	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.118599892 CET	3778	38636	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.118696928 CET	38636	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.118765116 CET	38636	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.123544931 CET	3778	38636	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.123614073 CET	38636	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.128498077 CET	3778	38636	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.372052908 CET	3778	38634	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.372337103 CET	38634	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.372432947 CET	38634	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.372484922 CET	38638	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.378730059 CET	3778	38638	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.378828049 CET	38638	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.378889084 CET	38638	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.384985924 CET	3778	38638	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:11.385063887 CET	38638	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:11.391648054 CET	3778	38638	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.025780916 CET	3778	38636	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.026067019 CET	38636	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.026067019 CET	38636	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.026310921 CET	38640	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.031122923 CET	3778	38640	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.031264067 CET	38640	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.031305075 CET	38640	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.036180019 CET	3778	38640	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.036262989 CET	38640	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.041138887 CET	3778	38640	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.313380957 CET	3778	38638	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.313771963 CET	38638	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.313772917 CET	38638	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.313842058 CET	38642	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.318779945 CET	3778	38642	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.318878889 CET	38642	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.318937063 CET	38642	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.323743105 CET	3778	38642	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.323823929 CET	38642	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.329021931 CET	3778	38642	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.926839113 CET	3778	38640	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.927190065 CET	38640	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.927191019 CET	38640	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.927242994 CET	38644	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.932233095 CET	3778	38644	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.932307005 CET	38644	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.932374001 CET	38644	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.937272072 CET	3778	38644	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:12.937361002 CET	38644	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:12.942229033 CET	3778	38644	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.225258112 CET	3778	38642	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.225490093 CET	38642	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.225627899 CET	38642	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.225641012 CET	38646	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.230437040 CET	3778	38646	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.230550051 CET	38646	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.230643034 CET	38646	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.235455036 CET	3778	38646	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.235501051 CET	38646	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.240292072 CET	3778	38646	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.845871925 CET	3778	38644	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.846173048 CET	38644	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.846173048 CET	38644	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.846201897 CET	38648	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.851036072 CET	3778	38648	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.851106882 CET	38648	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.851135969 CET	38648	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.855917931 CET	3778	38648	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:13.855983973 CET	38648	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:13.860790968 CET	3778	38648	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.144424915 CET	3778	38646	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.144613028 CET	38646	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.144661903 CET	38646	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.144746065 CET	38650	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.149647951 CET	3778	38650	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.149802923 CET	38650	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.149867058 CET	38650	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.154707909 CET	3778	38650	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.154771090 CET	38650	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.159635067 CET	3778	38650	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.752633095 CET	3778	38648	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.752850056 CET	38648	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.753026962 CET	38648	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.753130913 CET	38652	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.758187056 CET	3778	38652	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.758285046 CET	38652	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.758348942 CET	38652	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.763246059 CET	3778	38652	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:14.763308048 CET	38652	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:14.768268108 CET	3778	38652	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.049738884 CET	3778	38650	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.050193071 CET	38650	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.050194025 CET	38650	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.050199032 CET	38654	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.055289030 CET	3778	38654	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.055394888 CET	38654	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.055448055 CET	38654	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.060252905 CET	3778	38654	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.060322046 CET	38654	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.065253019 CET	3778	38654	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.660214901 CET	3778	38652	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.660429955 CET	38652	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.660566092 CET	38652	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.660763979 CET	38656	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.665710926 CET	3778	38656	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.666058064 CET	38656	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.666058064 CET	38656	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.671015024 CET	3778	38656	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.671103001 CET	38656	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.675915956 CET	3778	38656	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.918080091 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 10:47:15.918216944 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 10:47:15.948565006 CET	3778	38654	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.948679924 CET	38654	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.948679924 CET	38654	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.948842049 CET	38658	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.953747988 CET	3778	38658	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.953881025 CET	38658	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.953881025 CET	38658	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.958861113 CET	3778	38658	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:15.958944082 CET	38658	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:15.963800907 CET	3778	38658	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.567425013 CET	3778	38656	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.567750931 CET	38656	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.567836046 CET	38656	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.568070889 CET	38660	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.574404001 CET	3778	38660	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.574506044 CET	38660	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.574569941 CET	38660	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.579360962 CET	3778	38660	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.579473972 CET	38660	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.584383965 CET	3778	38660	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.847548962 CET	3778	38658	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.847938061 CET	38662	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.847987890 CET	38658	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.847989082 CET	38658	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.852919102 CET	3778	38662	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.853018999 CET	38662	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.853018999 CET	38662	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.857947111 CET	3778	38662	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:16.858067989 CET	38662	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:16.862885952 CET	3778	38662	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.466656923 CET	3778	38660	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.466989040 CET	38660	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.467096090 CET	38664	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.467098951 CET	38660	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.472126961 CET	3778	38664	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.472258091 CET	38664	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.472323895 CET	38664	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.477879047 CET	3778	38664	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.477973938 CET	38664	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.482784986 CET	3778	38664	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.776237965 CET	3778	38662	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.776549101 CET	38662	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.776549101 CET	38662	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.776559114 CET	38666	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.781888962 CET	3778	38666	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.782022953 CET	38666	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.782069921 CET	38666	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.787203074 CET	3778	38666	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:17.787331104 CET	38666	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:17.792646885 CET	3778	38666	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.416898012 CET	3778	38664	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.417078018 CET	38664	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.417078018 CET	38664	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.417186022 CET	38668	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.422068119 CET	3778	38668	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.422137976 CET	38668	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.422180891 CET	38668	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.426981926 CET	3778	38668	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.427047014 CET	38668	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.431866884 CET	3778	38668	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.675162077 CET	3778	38666	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.675374031 CET	38666	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.675447941 CET	38670	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.675467968 CET	38666	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.680421114 CET	3778	38670	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.680522919 CET	38670	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.680565119 CET	38670	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.685487032 CET	3778	38670	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:18.685564995 CET	38670	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:18.690530062 CET	3778	38670	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.322714090 CET	3778	38668	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.322874069 CET	38668	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.322943926 CET	38668	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.323105097 CET	38672	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.328052998 CET	3778	38672	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.328196049 CET	38672	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.328196049 CET	38672	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.333090067 CET	3778	38672	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.333168030 CET	38672	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.337992907 CET	3778	38672	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.580738068 CET	3778	38670	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.581054926 CET	38670	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.581056118 CET	38670	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.581120014 CET	38674	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.586132050 CET	3778	38674	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.586206913 CET	38674	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.586257935 CET	38674	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.591239929 CET	3778	38674	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:19.591300964 CET	38674	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:19.596218109 CET	3778	38674	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.229429007 CET	3778	38672	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.229741096 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.229772091 CET	38672	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.229772091 CET	38672	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.234925032 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.234997988 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.235037088 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.240032911 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.240122080 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.245127916 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.532808065 CET	3778	38674	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.532988071 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.532995939 CET	38674	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.532995939 CET	38674	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.537923098 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.537976980 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.537993908 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.542788029 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:20.542845964 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:20.547712088 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:30.243874073 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:30.248763084 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:30.546782970 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:30.552560091 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:30.562583923 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:30.562819958 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:30.865829945 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:47:30.866044044 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:47:44.586036921 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 10:48:30.610832930 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:48:30.615813017 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:48:30.911688089 CET	38678	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:48:30.916816950 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:48:30.929918051 CET	3778	38676	212.81.47.243	192.168.2.23
Jan 11, 2025 10:48:30.930119038 CET	38676	3778	192.168.2.23	212.81.47.243
Jan 11, 2025 10:48:31.230607033 CET	3778	38678	212.81.47.243	192.168.2.23
Jan 11, 2025 10:48:31.230962992 CET	38678	3778	192.168.2.23	212.81.47.243

System Behavior

Analysis Process: dash PID: 6245, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6245, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.ZJ32nmcMaW /tmp/tmp.L3KT3rEF10 /tmp/tmp.xVjHuqvBSS
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6246, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6246, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.ZJ32nmcMaW
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6247, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6247, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6248, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6248, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6249, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6249, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6250, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6250, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.ZJ32nmcMaW
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6251, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6251, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6252, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6252, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6253, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6253, Parent PID: 4331

General

Start time (UTC):	09:46:34
Start date (UTC):	11/01/2025
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6254, Parent PID: 4331

General

Start time (UTC):	09:46:35
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6254, Parent PID: 4331

General

Start time (UTC):	09:46:35
Start date (UTC):	11/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.ZJ32nmcMaW /tmp/tmp.L3KT3rEF10 /tmp/tmp.xVjHuqvBSS
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: Space.i686.elf PID: 6267, Parent PID: 6180

General

Start time (UTC):	09:46:43
Start date (UTC):	11/01/2025
Path:	/tmp/Space.i686.elf
Arguments:	/tmp/Space.i686.elf
File size:	38296 bytes
MD5 hash:	a6c1d7bc88a8a2a63e3aeda922848972

Chronological Activities

Analysis Process: Space.i686.elf PID: 6268, Parent PID: 6267

General

Start time (UTC):	09:46:43
Start date (UTC):	11/01/2025
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	38296 bytes
MD5 hash:	a6c1d7bc88a8a2a63e3aeda922848972

Chronological Activities

Analysis Process: Space.i686.elf PID: 6269, Parent PID: 6268

General

Start time (UTC):	09:46:43
Start date (UTC):	11/01/2025
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	38296 bytes
MD5 hash:	a6c1d7bc88a8a2a63e3aeda922848972

Chronological Activities

Analysis Process: Space.i686.elf PID: 6270, Parent PID: 6268

General

Start time (UTC):	09:46:43
Start date (UTC):	11/01/2025
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	38296 bytes
MD5 hash:	a6c1d7bc88a8a2a63e3aeda922848972

Analysis Process: Space.i686.elf PID: 6273, Parent PID: 6267

General

Start time (UTC):	09:46:49
Start date (UTC):	11/01/2025
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	38296 bytes
MD5 hash:	a6c1d7bc88a8a2a63e3aeda922848972

Chronological Activities

Analysis Process: Space.i686.elf PID: 6274, Parent PID: 6267

General

Start time (UTC):	09:46:49
Start date (UTC):	11/01/2025
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	38296 bytes
MD5 hash:	a6c1d7bc88a8a2a63e3aeda922848972

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6245, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6245, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6246, Parent PID: 4331

General

Chronological Activities

Analysis Process: cat PID: 6246, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6247, Parent PID: 4331

General

Chronological Activities

Analysis Process: head PID: 6247, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6248, Parent PID: 4331

General

Chronological Activities

Analysis Process: tr PID: 6248, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6249, Parent PID: 4331

Linux Analysis Report
Space.i686.elf