Edit tour

Linux Analysis Report
camp.i686.elf

Overview

General Information

Sample name:	camp.i686.elf
Analysis ID:	1590314
MD5:	483514bb42ee654258e940f65b232a5f
SHA1:	58f091a3ac14edad2c152d160de38fe84718b27e
SHA256:	9fdb05a173a620ca319e66b2641da6b01c72e84a96756e19136586113423767c
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590314
Start date and time:	2025-01-13 23:17:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	camp.i686.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/camp.i686.elf
PID:	5490
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5476, Parent: 3633)

rm (PID: 5476, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.pScubv6dkX /tmp/tmp.oGxbd58ACM /tmp/tmp.MHyqyFFA3h

dash New Fork (PID: 5477, Parent: 3633)

rm (PID: 5477, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.pScubv6dkX /tmp/tmp.oGxbd58ACM /tmp/tmp.MHyqyFFA3h

camp.i686.elf (PID: 5490, Parent: 5414, MD5: 483514bb42ee654258e940f65b232a5f) Arguments: /tmp/camp.i686.elf

camp.i686.elf New Fork (PID: 5491, Parent: 5490)

camp.i686.elf New Fork (PID: 5492, Parent: 5491)

camp.i686.elf New Fork (PID: 5493, Parent: 5491)

camp.i686.elf New Fork (PID: 5502, Parent: 5490)

camp.i686.elf New Fork (PID: 5503, Parent: 5490)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5490.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0x308:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0x27e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x2a42:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x2aa2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5491.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0x308:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0x27e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x2a42:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x2aa2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5491.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5492.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0x308:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0x27e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x2a42:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x2aa2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5492.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5502.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0x308:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0x27e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x2a42:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x2aa2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5502.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: camp.i686.elf PID: 5490	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.i686.elf PID: 5490	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x603:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x617:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x653:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x667:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.i686.elf PID: 5491	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.i686.elf PID: 5491	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.i686.elf PID: 5492	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.i686.elf PID: 5492	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.i686.elf PID: 5502	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 46 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: camp.i686.elf	Virustotal: Detection: 34%			Perma Link
Source: camp.i686.elf	ReversingLabs: Detection: 57%

Machine Learning detection for sample

Source: camp.i686.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.14:39340 -> 154.213.187.11:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11

Source: camp.i686.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: camp.i686.elf PID: 5490, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.i686.elf PID: 5491, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.i686.elf PID: 5492, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.i686.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: camp.i686.elf PID: 5490, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.i686.elf PID: 5491, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.i686.elf PID: 5492, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.i686.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1583/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/2672/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1577/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1593/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/3094/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/3406/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1589/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/3402/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/806/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/807/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/928/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/135/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/3412/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/1371/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/camp.i686.elf (PID: 5490)	File opened: /proc/265/status	Jump to behavior

Source: /usr/bin/dash (PID: 5476)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.pScubv6dkX /tmp/tmp.oGxbd58ACM /tmp/tmp.MHyqyFFA3h			Jump to behavior
Source: /usr/bin/dash (PID: 5477)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.pScubv6dkX /tmp/tmp.oGxbd58ACM /tmp/tmp.MHyqyFFA3h			Jump to behavior

Source: camp.i686.elf

Submission file: segment LOAD with 7.9584 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.i686.elf PID: 5490, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.i686.elf PID: 5491, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.i686.elf PID: 5492, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5491.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5492.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5502.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.i686.elf PID: 5490, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.i686.elf PID: 5491, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.i686.elf PID: 5492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
camp.i686.elf	34%	Virustotal		Browse
camp.i686.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
camp.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	camp.i686.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.213.187.11	unknown	Seychelles		22769	DDOSING-BGP-NETWORKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.213.187.11	camp.sh4.elf	Get hash	malicious	Mirai	Browse
	camp.spc.elf	Get hash	malicious	Mirai	Browse
	camp.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DDOSING-BGP-NETWORKUS	hikarm4.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	hikarm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.125
	hikarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	camp.sh4.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.spc.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.x86.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	mpsl.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	arm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	x86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.956249621870309
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	camp.i686.elf
File size:	35'948 bytes
MD5:	483514bb42ee654258e940f65b232a5f
SHA1:	58f091a3ac14edad2c152d160de38fe84718b27e
SHA256:	9fdb05a173a620ca319e66b2641da6b01c72e84a96756e19136586113423767c
SHA512:	15c6a8275e8b7b9ba1a9510444ee981c2dab992affa2ce6bc4bb49d9c4b20a8db5fd03f646020cc3319c2a0a11298485dd3f25b554e5a779c4be6f2883db9c18
SSDEEP:	768:4W/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfLSnbcuyD7UHQRjp:J4B1E+TcAYC9owuiySnouy8Hy1
TLSH:	DDF2F1F181668B0CD77C01FB44AD2A0E1885D868AC04D0B5DE847C739B25F69AEB2BD9
File Content Preview:	.ELF....................x...4...........4. ...(.....................l...l...............@...@...@...................Q.td.............................-[.UPX!........T$..T$......U..........?..k.I/.j....\.h.blz.e...)....4.0.N..9..y...@$. ..qX.\Z.....0.v'...%

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc08978
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x8b6c	0x8b6c	7.9584	0x5	R E	0x1000
LOAD	0xc40	0x805cc40	0x805cc40	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 23:18:02.636044025 CET	39340	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:02.641246080 CET	3778	39340	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:02.641339064 CET	39340	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:02.641572952 CET	39340	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:02.646373034 CET	3778	39340	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:02.646440983 CET	39340	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:02.651248932 CET	3778	39340	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:04.396785975 CET	3778	39340	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:04.397434950 CET	39340	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:04.402540922 CET	3778	39340	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:05.406056881 CET	39342	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:05.411050081 CET	3778	39342	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:05.411304951 CET	39342	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:05.411305904 CET	39342	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:05.416222095 CET	3778	39342	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:05.416459084 CET	39342	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:05.421298981 CET	3778	39342	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:08.233028889 CET	39344	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:08.238334894 CET	3778	39344	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:08.238400936 CET	39344	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:08.238444090 CET	39344	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:08.243328094 CET	3778	39344	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:08.243385077 CET	39344	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:08.248220921 CET	3778	39344	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:09.990413904 CET	3778	39344	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:09.991112947 CET	39344	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:09.997235060 CET	3778	39344	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:10.995511055 CET	39346	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:11.001959085 CET	3778	39346	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:11.002173901 CET	39346	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:11.002419949 CET	39346	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:11.007785082 CET	3778	39346	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:11.008240938 CET	39346	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:11.013731003 CET	3778	39346	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:12.459485054 CET	3778	39342	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:12.460349083 CET	39342	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:12.465740919 CET	3778	39342	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:13.464131117 CET	39348	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:13.473473072 CET	3778	39348	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:13.473579884 CET	39348	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:13.473615885 CET	39348	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:13.482803106 CET	3778	39348	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:13.482860088 CET	39348	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:13.492153883 CET	3778	39348	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:15.027770042 CET	3778	39346	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:15.028394938 CET	39346	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:15.033332109 CET	3778	39346	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:15.130064964 CET	3778	39348	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:15.130639076 CET	39348	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:15.137307882 CET	3778	39348	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:16.032232046 CET	39350	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.037290096 CET	3778	39350	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:16.037395954 CET	39350	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.037569046 CET	39350	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.042490959 CET	3778	39350	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:16.042598009 CET	39350	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.047426939 CET	3778	39350	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:16.133773088 CET	39352	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.138761997 CET	3778	39352	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:16.139070034 CET	39352	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.139070034 CET	39352	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.144098043 CET	3778	39352	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:16.144236088 CET	39352	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:16.149518013 CET	3778	39352	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:17.656537056 CET	3778	39350	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:17.657013893 CET	39350	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:17.661822081 CET	3778	39350	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:17.768841028 CET	3778	39352	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:17.768966913 CET	39352	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:17.773989916 CET	3778	39352	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:18.659738064 CET	39354	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.665158987 CET	3778	39354	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:18.665599108 CET	39354	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.665843964 CET	39354	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.671031952 CET	3778	39354	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:18.671310902 CET	39354	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.676438093 CET	3778	39354	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:18.771662951 CET	39356	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.776734114 CET	3778	39356	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:18.776897907 CET	39356	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.777072906 CET	39356	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.782001019 CET	3778	39356	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:18.782186985 CET	39356	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:18.787090063 CET	3778	39356	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:20.300620079 CET	3778	39354	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:20.301259995 CET	39354	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:20.306597948 CET	3778	39354	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:21.306881905 CET	39358	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:21.312134981 CET	3778	39358	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:21.312347889 CET	39358	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:21.312347889 CET	39358	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:21.317313910 CET	3778	39358	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:21.317496061 CET	39358	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:21.322256088 CET	3778	39358	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:22.812841892 CET	3778	39356	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:22.813127995 CET	39356	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:22.818093061 CET	3778	39356	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:22.918739080 CET	3778	39358	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:22.918962955 CET	39358	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:22.924259901 CET	3778	39358	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:23.816579103 CET	39360	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:23.922836065 CET	39362	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.785689116 CET	3778	39360	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:24.785761118 CET	3778	39362	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:24.785994053 CET	39360	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.785994053 CET	39362	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.786066055 CET	39360	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.786066055 CET	39362	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.791028976 CET	3778	39360	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:24.791109085 CET	39360	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.791126013 CET	3778	39362	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:24.791204929 CET	39362	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:24.796020031 CET	3778	39360	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:24.796122074 CET	3778	39362	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:26.387415886 CET	3778	39360	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:26.387964964 CET	39360	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:26.392962933 CET	3778	39360	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:26.426981926 CET	3778	39362	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:26.427536964 CET	39362	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:26.432409048 CET	3778	39362	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:27.391597986 CET	39364	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.397217035 CET	3778	39364	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:27.397636890 CET	39364	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.397743940 CET	39364	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.402875900 CET	3778	39364	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:27.403059959 CET	39364	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.408397913 CET	3778	39364	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:27.429970980 CET	39366	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.434902906 CET	3778	39366	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:27.435005903 CET	39366	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.435076952 CET	39366	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.439913034 CET	3778	39366	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:27.440078974 CET	39366	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:27.444930077 CET	3778	39366	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:29.029177904 CET	3778	39364	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:29.029711962 CET	39364	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:29.035064936 CET	3778	39364	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:29.060482025 CET	3778	39366	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:29.060874939 CET	39366	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:29.065901995 CET	3778	39366	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:30.034328938 CET	39368	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.039658070 CET	3778	39368	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:30.040005922 CET	39368	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.040142059 CET	39368	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.045485973 CET	3778	39368	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:30.045737028 CET	39368	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.050986052 CET	3778	39368	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:30.063776016 CET	39370	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.069008112 CET	3778	39370	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:30.069257975 CET	39370	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.069318056 CET	39370	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.074179888 CET	3778	39370	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:30.074275017 CET	39370	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:30.079309940 CET	3778	39370	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:31.656841040 CET	3778	39368	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:31.657234907 CET	39368	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:31.662451029 CET	3778	39368	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:31.703537941 CET	3778	39370	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:31.703886032 CET	39370	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:31.709052086 CET	3778	39370	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:32.661232948 CET	39372	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.666735888 CET	3778	39372	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:32.667242050 CET	39372	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.667242050 CET	39372	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.672517061 CET	3778	39372	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:32.672873974 CET	39372	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.678208113 CET	3778	39372	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:32.707726002 CET	39374	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.712966919 CET	3778	39374	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:32.713130951 CET	39374	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.713131905 CET	39374	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.718592882 CET	3778	39374	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:32.718856096 CET	39374	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:32.724267006 CET	3778	39374	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:34.313713074 CET	3778	39372	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:34.314245939 CET	39372	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:34.319531918 CET	3778	39372	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:34.344871044 CET	3778	39374	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:34.345310926 CET	39374	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:34.351021051 CET	3778	39374	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:35.317570925 CET	39376	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.322819948 CET	3778	39376	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:35.322890997 CET	39376	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.322931051 CET	39376	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.327975035 CET	3778	39376	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:35.328063011 CET	39376	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.333106995 CET	3778	39376	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:35.347183943 CET	39378	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.352024078 CET	3778	39378	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:35.352096081 CET	39378	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.352118015 CET	39378	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.356983900 CET	3778	39378	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:35.357049942 CET	39378	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:35.361804008 CET	3778	39378	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:42.366199970 CET	3778	39376	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:42.367091894 CET	39376	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:42.372591019 CET	3778	39376	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:43.372144938 CET	39380	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:43.377897024 CET	3778	39380	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:43.378319979 CET	39380	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:43.378446102 CET	39380	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:43.383579016 CET	3778	39380	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:43.383682013 CET	39380	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:43.389272928 CET	3778	39380	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:44.995773077 CET	3778	39380	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:44.996156931 CET	39380	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:45.003452063 CET	3778	39380	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:45.353818893 CET	39378	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:45.359657049 CET	3778	39378	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:46.000286102 CET	39382	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:46.005758047 CET	3778	39382	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:46.005973101 CET	39382	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:46.006057978 CET	39382	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:46.011112928 CET	3778	39382	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:46.011207104 CET	39382	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:46.016617060 CET	3778	39382	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:47.609466076 CET	3778	39382	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:47.609800100 CET	39382	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:47.615086079 CET	3778	39382	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:48.613194942 CET	39384	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:48.618566990 CET	3778	39384	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:48.618952036 CET	39384	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:48.618952036 CET	39384	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:48.624274015 CET	3778	39384	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:48.624634981 CET	39384	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:48.629789114 CET	3778	39384	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:48.904330969 CET	3778	39378	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:48.904731035 CET	39378	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:48.909925938 CET	3778	39378	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:49.908097982 CET	39386	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:49.913569927 CET	3778	39386	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:49.913722992 CET	39386	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:49.913805962 CET	39386	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:49.919503927 CET	3778	39386	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:49.919677973 CET	39386	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:49.925051928 CET	3778	39386	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:50.251851082 CET	3778	39384	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:50.252641916 CET	39384	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:50.258249998 CET	3778	39384	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:51.257425070 CET	39388	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:51.262947083 CET	3778	39388	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:51.263145924 CET	39388	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:51.263202906 CET	39388	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:51.268739939 CET	3778	39388	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:51.268956900 CET	39388	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:51.274354935 CET	3778	39388	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:51.513463020 CET	3778	39386	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:51.514264107 CET	39386	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:51.519954920 CET	3778	39386	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:52.517721891 CET	39390	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:52.523287058 CET	3778	39390	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:52.523454905 CET	39390	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:52.523523092 CET	39390	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:52.528740883 CET	3778	39390	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:52.528913975 CET	39390	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:52.534271955 CET	3778	39390	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:52.858839035 CET	3778	39388	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:52.859208107 CET	39388	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:52.864233017 CET	3778	39388	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:53.863466024 CET	39392	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:53.869083881 CET	3778	39392	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:53.869625092 CET	39392	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:53.869724989 CET	39392	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:53.875052929 CET	3778	39392	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:53.875400066 CET	39392	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:53.880726099 CET	3778	39392	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:54.122560978 CET	3778	39390	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:54.123116970 CET	39390	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:54.128607988 CET	3778	39390	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:55.127912998 CET	39394	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:55.133383036 CET	3778	39394	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:55.133522987 CET	39394	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:55.133604050 CET	39394	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:55.138906956 CET	3778	39394	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:55.139223099 CET	39394	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:55.144505978 CET	3778	39394	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:55.485805988 CET	3778	39392	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:55.486423969 CET	39392	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:55.491717100 CET	3778	39392	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:56.492662907 CET	39396	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:56.498403072 CET	3778	39396	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:56.498859882 CET	39396	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:56.498859882 CET	39396	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:56.504134893 CET	3778	39396	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:56.504571915 CET	39396	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:56.509876013 CET	3778	39396	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:56.770292997 CET	3778	39394	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:56.771249056 CET	39394	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:56.776748896 CET	3778	39394	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:57.777621031 CET	39398	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:57.783456087 CET	3778	39398	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:57.783593893 CET	39398	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:57.784102917 CET	39398	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:57.789841890 CET	3778	39398	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:57.790143013 CET	39398	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:57.795593023 CET	3778	39398	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:58.108654022 CET	3778	39396	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:58.109419107 CET	39396	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:58.114679098 CET	3778	39396	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:59.116425991 CET	39400	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:59.419358969 CET	3778	39400	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:59.419979095 CET	39400	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:59.419979095 CET	39400	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:59.422830105 CET	3778	39398	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:59.423398018 CET	39398	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:59.424937963 CET	3778	39400	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:59.425228119 CET	39400	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:18:59.428450108 CET	3778	39398	154.213.187.11	192.168.2.14
Jan 13, 2025 23:18:59.430201054 CET	3778	39400	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:00.428189993 CET	39402	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:00.433351994 CET	3778	39402	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:00.433588028 CET	39402	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:00.433748007 CET	39402	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:00.438939095 CET	3778	39402	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:00.439289093 CET	39402	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:00.444246054 CET	3778	39402	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:01.033121109 CET	3778	39400	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:01.033684969 CET	39400	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:01.038678885 CET	3778	39400	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:02.039074898 CET	39404	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:02.045039892 CET	3778	39404	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:02.045461893 CET	39404	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:02.045823097 CET	39404	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:02.047826052 CET	3778	39402	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:02.048213959 CET	39402	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:02.051390886 CET	3778	39404	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:02.051508904 CET	39404	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:02.053291082 CET	3778	39402	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:02.056950092 CET	3778	39404	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:03.054138899 CET	39406	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:03.059915066 CET	3778	39406	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:03.060339928 CET	39406	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:03.060719013 CET	39406	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:03.066108942 CET	3778	39406	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:03.066294909 CET	39406	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:03.071795940 CET	3778	39406	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:03.688872099 CET	3778	39404	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:03.689603090 CET	39404	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:03.695374966 CET	3778	39404	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:04.697069883 CET	39408	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:04.703071117 CET	3778	39408	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:04.703394890 CET	39408	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:04.703394890 CET	39408	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:04.708710909 CET	3778	39408	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:04.709127903 CET	39408	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:04.714607000 CET	3778	39408	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:04.907304049 CET	3778	39406	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:04.908143997 CET	39406	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:04.913439035 CET	3778	39406	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:05.914444923 CET	39410	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:05.919605017 CET	3778	39410	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:05.920216084 CET	39410	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:05.920216084 CET	39410	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:05.925219059 CET	3778	39410	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:05.925743103 CET	39410	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:05.930836916 CET	3778	39410	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:06.375879049 CET	3778	39408	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:06.376343966 CET	39408	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:06.381485939 CET	3778	39408	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:07.383399010 CET	39412	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:07.388901949 CET	3778	39412	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:07.389328003 CET	39412	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:07.389664888 CET	39412	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:07.395054102 CET	3778	39412	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:07.395345926 CET	39412	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:07.400939941 CET	3778	39412	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:07.608707905 CET	3778	39410	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:07.609411001 CET	39410	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:07.614619017 CET	3778	39410	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:08.616578102 CET	39414	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:08.622236013 CET	3778	39414	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:08.622535944 CET	39414	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:08.622643948 CET	39414	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:08.628062963 CET	3778	39414	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:08.628439903 CET	39414	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:08.634088039 CET	3778	39414	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:09.010921001 CET	3778	39412	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:09.011782885 CET	39412	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:09.017400980 CET	3778	39412	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:10.019006014 CET	39416	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:10.024975061 CET	3778	39416	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:10.025244951 CET	39416	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:10.025612116 CET	39416	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:10.030855894 CET	3778	39416	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:10.031164885 CET	39416	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:10.036757946 CET	3778	39416	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:10.272969961 CET	3778	39414	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:10.273653030 CET	39414	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:10.279026985 CET	3778	39414	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:11.281392097 CET	39418	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:11.286938906 CET	3778	39418	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:11.287460089 CET	39418	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:11.287620068 CET	39418	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:11.292634964 CET	3778	39418	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:11.292900085 CET	39418	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:11.298635006 CET	3778	39418	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:11.677206993 CET	3778	39416	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:11.678081036 CET	39416	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:11.683593988 CET	3778	39416	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:12.683598995 CET	39420	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:12.688968897 CET	3778	39420	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:12.689475060 CET	39420	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:12.689722061 CET	39420	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:12.695003986 CET	3778	39420	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:12.695321083 CET	39420	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:12.700673103 CET	3778	39420	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:12.890522003 CET	3778	39418	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:12.891307116 CET	39418	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:12.896656990 CET	3778	39418	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:13.898116112 CET	39422	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:13.903671980 CET	3778	39422	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:13.903855085 CET	39422	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:13.904037952 CET	39422	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:13.909307003 CET	3778	39422	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:13.909775972 CET	39422	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:13.915339947 CET	3778	39422	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:14.362801075 CET	3778	39420	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:14.363657951 CET	39420	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:14.369102001 CET	3778	39420	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:15.369427919 CET	39424	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:15.375406027 CET	3778	39424	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:15.375725031 CET	39424	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:15.375829935 CET	39424	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:15.381441116 CET	3778	39424	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:15.381673098 CET	39424	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:15.387826920 CET	3778	39424	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:15.515407085 CET	3778	39422	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:15.515739918 CET	39422	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:15.520917892 CET	3778	39422	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:16.518798113 CET	39426	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:16.524347067 CET	3778	39426	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:16.524761915 CET	39426	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:16.524890900 CET	39426	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:16.530178070 CET	3778	39426	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:16.530458927 CET	39426	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:16.536042929 CET	3778	39426	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:16.987278938 CET	3778	39424	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:16.988147974 CET	39424	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:16.994170904 CET	3778	39424	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:17.992404938 CET	39428	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:17.997845888 CET	3778	39428	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:17.998306990 CET	39428	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:17.998471975 CET	39428	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:18.003405094 CET	3778	39428	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:18.003516912 CET	39428	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:18.008426905 CET	3778	39428	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:18.157610893 CET	3778	39426	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:18.158075094 CET	39426	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:18.163470030 CET	3778	39426	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:19.165147066 CET	39430	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:19.170907974 CET	3778	39430	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:19.171308041 CET	39430	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:19.171308041 CET	39430	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:19.176758051 CET	3778	39430	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:19.177335978 CET	39430	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:19.182688951 CET	3778	39430	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:19.622383118 CET	3778	39428	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:19.623153925 CET	39428	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:19.628593922 CET	3778	39428	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:20.627964020 CET	39432	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:20.632879019 CET	3778	39432	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:20.632965088 CET	39432	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:20.633210897 CET	39432	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:20.637979031 CET	3778	39432	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:20.638254881 CET	39432	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:20.643109083 CET	3778	39432	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:20.800750971 CET	3778	39430	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:20.801538944 CET	39430	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:20.807070971 CET	3778	39430	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:21.808490992 CET	39434	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:21.813847065 CET	3778	39434	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:21.814147949 CET	39434	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:21.814388037 CET	39434	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:21.819277048 CET	3778	39434	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:21.819580078 CET	39434	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:21.824439049 CET	3778	39434	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:22.283191919 CET	3778	39432	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:22.284133911 CET	39432	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:22.289302111 CET	3778	39432	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:23.291588068 CET	39436	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:23.297342062 CET	3778	39436	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:23.297463894 CET	39436	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:23.298048973 CET	39436	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:23.303540945 CET	3778	39436	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:23.303657055 CET	39436	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:23.309269905 CET	3778	39436	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:23.460692883 CET	3778	39434	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:23.461409092 CET	39434	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:23.466725111 CET	3778	39434	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:24.468230009 CET	39438	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:24.473803997 CET	3778	39438	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:24.474076033 CET	39438	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:24.474531889 CET	39438	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:24.479428053 CET	3778	39438	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:24.479815960 CET	39438	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:24.484688044 CET	3778	39438	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:24.925546885 CET	3778	39436	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:24.926266909 CET	39436	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:24.931809902 CET	3778	39436	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:25.931345940 CET	39440	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:25.936429977 CET	3778	39440	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:25.936707020 CET	39440	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:25.936707973 CET	39440	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:25.942222118 CET	3778	39440	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:25.942683935 CET	39440	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:25.948225975 CET	3778	39440	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:26.111077070 CET	3778	39438	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:26.111826897 CET	39438	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:26.117106915 CET	3778	39438	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:27.118666887 CET	39442	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:27.124510050 CET	3778	39442	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:27.124882936 CET	39442	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:27.125325918 CET	39442	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:27.130740881 CET	3778	39442	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:27.130966902 CET	39442	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:27.136033058 CET	3778	39442	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:28.799231052 CET	3778	39442	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:28.799835920 CET	39442	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:28.805389881 CET	3778	39442	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:29.805449963 CET	39444	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:29.811382055 CET	3778	39444	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:29.811932087 CET	39444	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:29.811933041 CET	39444	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:29.817496061 CET	3778	39444	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:29.818093061 CET	39444	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:29.823497057 CET	3778	39444	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:31.403866053 CET	3778	39444	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:31.404455900 CET	39444	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:31.409940958 CET	3778	39444	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:32.410029888 CET	39446	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:32.415977001 CET	3778	39446	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:32.416415930 CET	39446	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:32.416522026 CET	39446	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:32.422415018 CET	3778	39446	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:32.422725916 CET	39446	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:32.428303003 CET	3778	39446	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:32.972479105 CET	3778	39440	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:32.973169088 CET	39440	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:32.978434086 CET	3778	39440	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:33.978820086 CET	39448	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:33.984051943 CET	3778	39448	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:33.984508038 CET	39448	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:33.984508038 CET	39448	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:33.989973068 CET	3778	39448	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:33.990379095 CET	39448	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:33.995506048 CET	3778	39448	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:34.034619093 CET	3778	39446	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:34.035377026 CET	39446	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:34.040744066 CET	3778	39446	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:35.041687965 CET	39450	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:35.047640085 CET	3778	39450	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:35.048151016 CET	39450	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:35.048259020 CET	39450	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:35.053752899 CET	3778	39450	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:35.054212093 CET	39450	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:35.059883118 CET	3778	39450	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:35.591751099 CET	3778	39448	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:35.592375040 CET	39448	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:35.597680092 CET	3778	39448	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:36.597343922 CET	39452	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:36.602283955 CET	3778	39452	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:36.602394104 CET	39452	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:36.602463961 CET	39452	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:36.607275009 CET	3778	39452	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:36.607358932 CET	39452	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:36.612148046 CET	3778	39452	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:38.234716892 CET	3778	39452	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:38.235493898 CET	39452	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:38.240834951 CET	3778	39452	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:39.241496086 CET	39454	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:39.246882915 CET	3778	39454	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:39.247107983 CET	39454	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:39.247215033 CET	39454	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:39.252017021 CET	3778	39454	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:39.252142906 CET	39454	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:39.257016897 CET	3778	39454	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:40.863253117 CET	3778	39454	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:40.863835096 CET	39454	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:40.868854046 CET	3778	39454	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:41.867690086 CET	39456	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:41.873203039 CET	3778	39456	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:41.873349905 CET	39456	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:41.873646975 CET	39456	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:41.878966093 CET	3778	39456	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:41.879086971 CET	39456	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:41.884005070 CET	3778	39456	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:43.487045050 CET	3778	39456	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:43.487847090 CET	39456	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:43.492909908 CET	3778	39456	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:44.494273901 CET	39458	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:44.499502897 CET	3778	39458	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:44.499973059 CET	39458	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:44.500092983 CET	39458	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:44.504925966 CET	3778	39458	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:44.505219936 CET	39458	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:44.510179043 CET	3778	39458	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:46.158832073 CET	3778	39458	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:46.159703016 CET	39458	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:46.165190935 CET	3778	39458	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:47.165694952 CET	39460	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:47.171272039 CET	3778	39460	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:47.171463966 CET	39460	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:47.171660900 CET	39460	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:47.176652908 CET	3778	39460	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:47.176784039 CET	39460	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:47.181766987 CET	3778	39460	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:48.656290054 CET	3778	39450	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:48.656800985 CET	39450	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:48.661851883 CET	3778	39450	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:48.802094936 CET	3778	39460	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:48.802550077 CET	39460	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:48.808087111 CET	3778	39460	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:49.662823915 CET	39462	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.668589115 CET	3778	39462	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:49.669207096 CET	39462	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.669207096 CET	39462	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.674892902 CET	3778	39462	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:49.675380945 CET	39462	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.680768013 CET	3778	39462	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:49.807744980 CET	39464	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.813199997 CET	3778	39464	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:49.813472033 CET	39464	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.813570023 CET	39464	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.819013119 CET	3778	39464	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:49.819278002 CET	39464	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:49.824832916 CET	3778	39464	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:51.362159014 CET	3778	39462	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:51.362910986 CET	39462	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:51.368204117 CET	3778	39462	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:51.453808069 CET	3778	39464	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:51.454430103 CET	39464	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:51.459810019 CET	3778	39464	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:52.369615078 CET	39466	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.375158072 CET	3778	39466	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:52.375643015 CET	39466	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.375755072 CET	39466	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.380949020 CET	3778	39466	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:52.381346941 CET	39466	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.386734962 CET	3778	39466	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:52.459162951 CET	39468	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.464720964 CET	3778	39468	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:52.465003014 CET	39468	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.465003014 CET	39468	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.470460892 CET	3778	39468	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:52.471045971 CET	39468	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:52.476634026 CET	3778	39468	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:53.986675978 CET	3778	39466	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:53.987662077 CET	39466	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:53.993041039 CET	3778	39466	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:54.080362082 CET	3778	39468	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:54.081142902 CET	39468	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:54.086431980 CET	3778	39468	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:54.994148970 CET	39470	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:54.999982119 CET	3778	39470	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:55.000632048 CET	39470	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.000752926 CET	39470	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.006222963 CET	3778	39470	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:55.006608009 CET	39470	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.011945963 CET	3778	39470	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:55.086116076 CET	39472	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.091568947 CET	3778	39472	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:55.092154026 CET	39472	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.092154026 CET	39472	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.097579956 CET	3778	39472	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:55.098249912 CET	39472	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:55.103864908 CET	3778	39472	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:56.629411936 CET	3778	39470	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:56.630429983 CET	39470	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:56.636071920 CET	3778	39470	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:56.721729040 CET	3778	39472	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:56.722517014 CET	39472	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:56.728195906 CET	3778	39472	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:57.636039972 CET	39474	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.641844034 CET	3778	39474	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:57.642210007 CET	39474	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.642316103 CET	39474	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.647947073 CET	3778	39474	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:57.648241043 CET	39474	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.653805017 CET	3778	39474	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:57.726035118 CET	39476	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.731224060 CET	3778	39476	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:57.731641054 CET	39476	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.731755972 CET	39476	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.736865997 CET	3778	39476	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:57.737340927 CET	39476	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:57.742741108 CET	3778	39476	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:59.254275084 CET	3778	39474	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:59.255160093 CET	39474	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:59.260751009 CET	3778	39474	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:59.364500999 CET	3778	39476	154.213.187.11	192.168.2.14
Jan 13, 2025 23:19:59.365288019 CET	39476	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:19:59.371068001 CET	3778	39476	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:00.261642933 CET	39478	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.370481014 CET	39480	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.559972048 CET	3778	39478	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:00.560026884 CET	3778	39480	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:00.560527086 CET	39480	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.560539007 CET	39478	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.560723066 CET	39478	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.560734034 CET	39480	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.566029072 CET	3778	39478	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:00.566076040 CET	3778	39480	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:00.566267014 CET	39480	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.566283941 CET	39478	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:00.571082115 CET	3778	39480	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:00.571197987 CET	3778	39478	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:02.155616999 CET	3778	39480	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:02.156411886 CET	39480	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:02.157464981 CET	3778	39478	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:02.157676935 CET	39478	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:02.161875010 CET	3778	39480	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:02.163357019 CET	3778	39478	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:03.164077044 CET	39482	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.164267063 CET	39484	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.169810057 CET	3778	39482	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:03.169939041 CET	3778	39484	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:03.170239925 CET	39482	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.170372963 CET	39484	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.170382023 CET	39482	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.170373917 CET	39484	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.175705910 CET	3778	39482	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:03.176016092 CET	39482	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.176402092 CET	3778	39484	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:03.176804066 CET	39484	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:03.181816101 CET	3778	39482	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:03.182061911 CET	3778	39484	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:04.785551071 CET	3778	39482	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:04.786128998 CET	39482	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:04.791583061 CET	3778	39482	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:04.803226948 CET	3778	39484	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:04.803759098 CET	39484	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:04.808959961 CET	3778	39484	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:05.791158915 CET	39486	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.796844006 CET	3778	39486	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:05.797245979 CET	39486	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.797245979 CET	39486	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.802598000 CET	3778	39486	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:05.803046942 CET	39486	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.807933092 CET	39488	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.808608055 CET	3778	39486	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:05.813488960 CET	3778	39488	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:05.813807011 CET	39488	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.813941956 CET	39488	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.819278955 CET	3778	39488	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:05.819653988 CET	39488	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:05.824781895 CET	3778	39488	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:07.471564054 CET	3778	39486	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:07.472311020 CET	39486	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:07.477993011 CET	3778	39486	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:07.503443956 CET	3778	39488	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:07.503942966 CET	39488	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:07.503942966 CET	39488	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:07.509532928 CET	3778	39488	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:08.478128910 CET	39490	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.484086037 CET	3778	39490	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:08.484781981 CET	39490	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.484781981 CET	39490	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.490434885 CET	3778	39490	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:08.490936041 CET	39490	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.496474981 CET	3778	39490	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:08.507400036 CET	39492	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.690176010 CET	3778	39492	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:08.690586090 CET	39492	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.690587044 CET	39492	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.696176052 CET	3778	39492	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:08.696341991 CET	39492	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:08.701253891 CET	3778	39492	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:10.225065947 CET	3778	39490	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:10.225852013 CET	39490	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:10.231467962 CET	3778	39490	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:10.554917097 CET	3778	39492	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:10.555455923 CET	39492	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:10.560471058 CET	3778	39492	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:11.232613087 CET	39494	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.238554001 CET	3778	39494	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:11.239111900 CET	39494	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.239381075 CET	39494	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.244805098 CET	3778	39494	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:11.245258093 CET	39494	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.250765085 CET	3778	39494	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:11.560918093 CET	39496	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.566672087 CET	3778	39496	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:11.566886902 CET	39496	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.567012072 CET	39496	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.571996927 CET	3778	39496	154.213.187.11	192.168.2.14
Jan 13, 2025 23:20:11.572237015 CET	39496	3778	192.168.2.14	154.213.187.11
Jan 13, 2025 23:20:11.577316999 CET	3778	39496	154.213.187.11	192.168.2.14

System Behavior

Analysis Process: dash PID: 5476, Parent PID: 3633

General

Start time (UTC):	22:17:50
Start date (UTC):	13/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5476, Parent PID: 3633

General

Start time (UTC):	22:17:50
Start date (UTC):	13/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.pScubv6dkX /tmp/tmp.oGxbd58ACM /tmp/tmp.MHyqyFFA3h
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5477, Parent PID: 3633

General

Start time (UTC):	22:17:50
Start date (UTC):	13/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5477, Parent PID: 3633

General

Start time (UTC):	22:17:50
Start date (UTC):	13/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.pScubv6dkX /tmp/tmp.oGxbd58ACM /tmp/tmp.MHyqyFFA3h
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: camp.i686.elf PID: 5490, Parent PID: 5414

General

Start time (UTC):	22:18:01
Start date (UTC):	13/01/2025
Path:	/tmp/camp.i686.elf
Arguments:	/tmp/camp.i686.elf
File size:	35948 bytes
MD5 hash:	483514bb42ee654258e940f65b232a5f

Chronological Activities

Analysis Process: camp.i686.elf PID: 5491, Parent PID: 5490

General

Start time (UTC):	22:18:01
Start date (UTC):	13/01/2025
Path:	/tmp/camp.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	483514bb42ee654258e940f65b232a5f

Chronological Activities

Analysis Process: camp.i686.elf PID: 5492, Parent PID: 5491

General

Start time (UTC):	22:18:01
Start date (UTC):	13/01/2025
Path:	/tmp/camp.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	483514bb42ee654258e940f65b232a5f

Chronological Activities

Analysis Process: camp.i686.elf PID: 5493, Parent PID: 5491

General

Start time (UTC):	22:18:01
Start date (UTC):	13/01/2025
Path:	/tmp/camp.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	483514bb42ee654258e940f65b232a5f

Chronological Activities

Analysis Process: camp.i686.elf PID: 5502, Parent PID: 5490

General

Start time (UTC):	22:18:07
Start date (UTC):	13/01/2025
Path:	/tmp/camp.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	483514bb42ee654258e940f65b232a5f

Chronological Activities

Analysis Process: camp.i686.elf PID: 5503, Parent PID: 5490

General

Start time (UTC):	22:18:07
Start date (UTC):	13/01/2025
Path:	/tmp/camp.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	483514bb42ee654258e940f65b232a5f

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report camp.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 5476, Parent PID: 3633

General

Chronological Activities

Analysis Process: rm PID: 5476, Parent PID: 3633

General

Chronological Activities

Analysis Process: dash PID: 5477, Parent PID: 3633

General

Chronological Activities

Analysis Process: rm PID: 5477, Parent PID: 3633

General

Chronological Activities

Analysis Process: camp.i686.elf PID: 5490, Parent PID: 5414

General

Chronological Activities

Analysis Process: camp.i686.elf PID: 5491, Parent PID: 5490

General

Chronological Activities

Analysis Process: camp.i686.elf PID: 5492, Parent PID: 5491

General

Linux Analysis Report
camp.i686.elf