Edit tour

Linux Analysis Report
camp.m68k.elf

Overview

General Information

Sample name:	camp.m68k.elf
Analysis ID:	1590320
MD5:	6fad024461b2d64710339428b62888b0
SHA1:	0cf7eb58142b429e08983d905ca11ead8da7d010
SHA256:	15473b5753c27e9509b2e10c883f3a1c14ae14856069836579ed0f9e3155dca7
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590320
Start date and time:	2025-01-13 23:25:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	camp.m68k.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/camp.m68k.elf
PID:	6261
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

camp.m68k.elf (PID: 6261, Parent: 6184, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/camp.m68k.elf

camp.m68k.elf New Fork (PID: 6263, Parent: 6261)

camp.m68k.elf New Fork (PID: 6265, Parent: 6263)

camp.m68k.elf New Fork (PID: 6267, Parent: 6263)

camp.m68k.elf New Fork (PID: 6273, Parent: 6261)

camp.m68k.elf New Fork (PID: 6274, Parent: 6261)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
camp.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
camp.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6273.1.00007f2448001000.00007f2448016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6273.1.00007f2448001000.00007f2448016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6265.1.00007f2448001000.00007f2448016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6265.1.00007f2448001000.00007f2448016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6263.1.00007f2448001000.00007f2448016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6263.1.00007f2448001000.00007f2448016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6261.1.00007f2448001000.00007f2448016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6261.1.00007f2448001000.00007f2448016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.m68k.elf PID: 6261	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.m68k.elf PID: 6261	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xbc6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbce6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.m68k.elf PID: 6263	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.m68k.elf PID: 6263	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4caf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.m68k.elf PID: 6265	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.m68k.elf PID: 6265	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3add:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3af1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ba5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bcd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3be1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.m68k.elf PID: 6273	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.m68k.elf PID: 6273	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa44c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa49c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa53c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa58c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: camp.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: camp.m68k.elf	Virustotal: Detection: 61%			Perma Link
Source: camp.m68k.elf	ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.23:47544 -> 154.213.187.11:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: camp.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6273.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6265.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6263.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6261.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.m68k.elf PID: 6263, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.m68k.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.m68k.elf PID: 6273, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc/proc/proc/%d/exe/proc/%s/statusName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog154.213.187.11

Source: ELF static info symbol of initial sample

.symtab present: no

Source: camp.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6273.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6265.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6263.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6261.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.m68k.elf PID: 6263, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.m68k.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.m68k.elf PID: 6273, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/6234/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/6245/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/6244/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/4507/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/6267/status	Jump to behavior
Source: /tmp/camp.m68k.elf (PID: 6261)	File opened: /proc/1809/status	Jump to behavior

Source: /tmp/camp.m68k.elf (PID: 6261)

Queries kernel information via 'uname':

Jump to behavior

Source: camp.m68k.elf, 6261.1.00005589091e0000.0000558909265000.rw-.sdmp, camp.m68k.elf, 6263.1.00005589091e0000.0000558909265000.rw-.sdmp, camp.m68k.elf, 6265.1.00005589091e0000.0000558909265000.rw-.sdmp, camp.m68k.elf, 6273.1.00005589091e0000.0000558909265000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: camp.m68k.elf, 6261.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp, camp.m68k.elf, 6263.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp, camp.m68k.elf, 6265.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp, camp.m68k.elf, 6273.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: camp.m68k.elf, 6261.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp, camp.m68k.elf, 6263.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp, camp.m68k.elf, 6265.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp, camp.m68k.elf, 6273.1.00007ffeaa4d1000.00007ffeaa4f2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/camp.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/camp.m68k.elf
Source: camp.m68k.elf, 6261.1.00005589091e0000.0000558909265000.rw-.sdmp, camp.m68k.elf, 6263.1.00005589091e0000.0000558909265000.rw-.sdmp, camp.m68k.elf, 6265.1.00005589091e0000.0000558909265000.rw-.sdmp, camp.m68k.elf, 6273.1.00005589091e0000.0000558909265000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: camp.m68k.elf, type: SAMPLE
Source: Yara match	File source: 6273.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6263.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6265, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6273, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: camp.m68k.elf, type: SAMPLE
Source: Yara match	File source: 6273.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6263.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.00007f2448001000.00007f2448016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6265, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.m68k.elf PID: 6273, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
camp.m68k.elf	61%	Virustotal		Browse
camp.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
camp.m68k.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
154.213.187.11	unknown	Seychelles	22769	DDOSING-BGP-NETWORKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	camp.ppc.elf	Get hash	malicious	Mirai	Browse
	camp.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	dlr.x86.elf	Get hash	malicious	Unknown	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.42	camp.ppc.elf	Get hash	malicious	Mirai	Browse
	camp.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	dlr.x86.elf	Get hash	malicious	Unknown	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	camp.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	camp.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
CANONICAL-ASGB	camp.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	camp.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
INIT7CH	camp.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	camp.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
DDOSING-BGP-NETWORKUS	camp.arm.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.ppc.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.mpsl.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.arm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.x86_64.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.i686.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	hikarm4.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	hikarm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.125
	hikarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.298366306765848
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	camp.m68k.elf
File size:	84'960 bytes
MD5:	6fad024461b2d64710339428b62888b0
SHA1:	0cf7eb58142b429e08983d905ca11ead8da7d010
SHA256:	15473b5753c27e9509b2e10c883f3a1c14ae14856069836579ed0f9e3155dca7
SHA512:	ac8283cd945cf3bca436e7ec30aa2403a4b80b2c81ec55f837e8069d5b8db66f8bea179c36dc3d79d064aadd1eabded444fe99388f5cfbe89f3e3aa8c7c185e9
SSDEEP:	1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7IFn:4G5hLsd9lJP4npeqp+psrbIFn
TLSH:	7A83199AF800DDBDF80FDAB74463490EB931E3910A931A377767BD53AC721A14826E85
File Content Preview:	.ELF.......................D...4..JP.....4. ...(......................F...F....... .......F...f...f....l..(\...... .dt.Q............................NV..a....da....4N^NuNV..J9..j.f>"y..f. QJ.g.X.#...f.N."y..f. QJ.f.A.....J.g.Hy..F.N.X.......j.N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	84560
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x11b5e	0x0	0x6	AX	4
.fini	PROGBITS	0x80011c06	0x11c06	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80011c14	0x11c14	0x2a8a	0x0	0x2	A	2
.ctors	PROGBITS	0x800166a4	0x146a4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x800166ac	0x146ac	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800166b8	0x146b8	0x358	0x0	0x3	WA	4
.bss	NOBITS	0x80016a10	0x14a10	0x24f0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x14a10	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1469e	0x1469e	6.3287	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x146a4	0x800166a4	0x800166a4	0x36c	0x285c	2.8711	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 23:26:20.360735893 CET	43928	443	192.168.2.23	91.189.91.42
Jan 13, 2025 23:26:20.950515032 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:20.955595970 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:20.955658913 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:21.008632898 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:21.013649940 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:21.013720036 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:21.018605947 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:22.581132889 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:22.581511974 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:22.586363077 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:23.584002018 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:23.589030027 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:23.589133024 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:23.589977026 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:23.596844912 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:23.596909046 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:23.601741076 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:24.200207949 CET	42516	80	192.168.2.23	109.202.202.202
Jan 13, 2025 23:26:25.213407993 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:25.213830948 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:25.218704939 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:25.991970062 CET	42836	443	192.168.2.23	91.189.91.43
Jan 13, 2025 23:26:26.215559959 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:26.220523119 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:26.220596075 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:26.221601009 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:26.226458073 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:26.226515055 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:26.231343985 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:27.818579912 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:27.818841934 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:27.818922043 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:27.823507071 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:27.823554993 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:27.823776007 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:27.840354919 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:27.845345974 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:27.845457077 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:27.850271940 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:28.824059963 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:28.829180956 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:28.829281092 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:28.831728935 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:28.836534977 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:28.836604118 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:28.841430902 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:29.428045988 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:29.428514004 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:29.433408976 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:30.430464029 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:30.435431957 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:30.435529947 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:30.436311007 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:30.441075087 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:30.441138983 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:30.445940971 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:32.058844090 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:32.059412956 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:32.064337015 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:33.079519987 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:33.084662914 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:33.084852934 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:33.103527069 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:33.108355999 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:33.108433008 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:33.113363028 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:34.716975927 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:34.717588902 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:34.722630024 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:35.720314026 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:35.725578070 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:35.725677967 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:35.726974010 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:35.731852055 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:35.731920958 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:35.736759901 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:35.869874001 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:35.870263100 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:35.875365973 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:36.873167992 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:36.878633022 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:36.878784895 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:36.880037069 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:36.884905100 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:36.884984970 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:36.889849901 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:37.354168892 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:37.354402065 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:37.354454994 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:37.359359980 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:38.359194040 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:38.364705086 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:38.364820957 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:38.366262913 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:38.371104002 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:38.371176958 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:38.376043081 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:38.496704102 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:38.497230053 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:38.502482891 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:39.501517057 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:39.506742954 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:39.506872892 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:39.508291960 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:39.513123035 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:39.513190031 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:39.518147945 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:39.994659901 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:39.994937897 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:39.999874115 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:40.997651100 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:41.003623962 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:41.003803968 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:41.005264997 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:41.010149002 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:41.010231972 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:41.015101910 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:41.101988077 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:41.102380991 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:41.107441902 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:41.861886024 CET	43928	443	192.168.2.23	91.189.91.42
Jan 13, 2025 23:26:42.105443954 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:42.110557079 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:42.110661030 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:42.112288952 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:42.117126942 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:42.117196083 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:42.122075081 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:42.638793945 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:42.639405012 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:42.644337893 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:43.642679930 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:43.647542000 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:43.647685051 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:43.649238110 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:43.654093027 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:43.654165983 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:43.658971071 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:43.744632006 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:43.745187998 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:43.750085115 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:44.749695063 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:44.754746914 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:44.754848957 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:44.756340027 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:44.761106968 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:44.761182070 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:44.766032934 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:45.277307034 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:45.277825117 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:45.282818079 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:46.281286955 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:46.286150932 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:46.286250114 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:46.287746906 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:46.292639017 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:46.292762995 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:46.297594070 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:46.350666046 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:46.350975037 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:46.355818987 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:47.356637001 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:47.361916065 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:47.362023115 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:47.364518881 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:47.369425058 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:47.369568110 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:47.374491930 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:47.900573015 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:47.901268959 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:47.906241894 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:48.905575991 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:48.910553932 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:48.910729885 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:48.912375927 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:48.917344093 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:48.917426109 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:48.922424078 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:48.975533962 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:48.975997925 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:48.981024981 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:49.979974985 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:49.985255957 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:49.985358953 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:49.986792088 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:49.991738081 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:49.991812944 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:49.996753931 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:52.100613117 CET	42836	443	192.168.2.23	91.189.91.43
Jan 13, 2025 23:26:52.960062027 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:52.960400105 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:52.965281010 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:53.964332104 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:53.969616890 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:53.969719887 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:53.971236944 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:53.976156950 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:53.976293087 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:53.981206894 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:54.148277998 CET	42516	80	192.168.2.23	109.202.202.202
Jan 13, 2025 23:26:55.588613033 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:55.588800907 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:55.593733072 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:56.593327045 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:56.652326107 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:56.652591944 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:56.655632019 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:56.660713911 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:56.660967112 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:56.665821075 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:58.276546955 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:58.277138948 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:58.282098055 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:59.283648968 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:59.288609028 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:59.288877010 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:59.291335106 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:59.296344042 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:59.296591997 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:26:59.301634073 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:26:59.995440960 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:00.000550032 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:00.918504953 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:00.919083118 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:00.924155951 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:01.926299095 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:01.932056904 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:01.932326078 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:01.934951067 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:01.940270901 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:01.940481901 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:01.945327997 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:03.543210983 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:03.543817043 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:03.548767090 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:03.576435089 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:03.576998949 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:03.582046032 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:04.550743103 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.555922031 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:04.556080103 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.558813095 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.563720942 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:04.564024925 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.568873882 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:04.581954002 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.587399960 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:04.587836981 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.590590954 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.595837116 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:04.596175909 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:04.601355076 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:06.178678989 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:06.179306984 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:06.184454918 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:06.185996056 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:06.186280012 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:06.191287994 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:07.186223984 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.189663887 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.191256046 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:07.191368103 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.192594051 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.194525003 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:07.194602013 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.195723057 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.197438955 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:07.197519064 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.200575113 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:07.200639963 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:07.202330112 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:07.205530882 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:08.825637102 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:08.825942993 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:08.830740929 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:08.843992949 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:08.844291925 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:08.849148989 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:09.831044912 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.836198092 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:09.836299896 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.838921070 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.843781948 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:09.843861103 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.848088026 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.848925114 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:09.853178024 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:09.853274107 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.855237961 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.860076904 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:09.860176086 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:09.865005016 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:11.508785963 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:11.509299040 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:11.510296106 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:11.510437012 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:11.514264107 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:11.515307903 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:12.515347958 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.516119957 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.520678997 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:12.520766020 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.521048069 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:12.521250010 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.524451017 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.524878025 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.529480934 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:12.529719114 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.529762030 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:12.530087948 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:12.534574986 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:12.534991980 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:14.135341883 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:14.135951042 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:14.136943102 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:14.137063026 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:14.140943050 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:14.141966105 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:15.140608072 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.140882969 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.145808935 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:15.145859003 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:15.145987034 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.146074057 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.148663998 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.148780107 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.153615952 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:15.153645992 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:15.153732061 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.153815985 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:15.158607960 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:15.158687115 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:16.760762930 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:16.761442900 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:16.766298056 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:16.797337055 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:16.797674894 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:16.802772045 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:17.766124964 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.770987034 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:17.771059036 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.772644997 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.777470112 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:17.777677059 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.782428980 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:17.802983046 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.807806969 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:17.808128119 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.810087919 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.814930916 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:17.815011024 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:17.820034981 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:19.385276079 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:19.385631084 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:19.390476942 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:19.456187010 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:19.456707954 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:19.461760044 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:20.390706062 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.396336079 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:20.396431923 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.397964954 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.402842999 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:20.402909040 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.407809019 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:20.461385012 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.466634989 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:20.466712952 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.468549013 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.473368883 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:20.473427057 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:20.478302956 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:22.010305882 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:22.010658979 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:22.015620947 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:22.108120918 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:22.108500957 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:22.113351107 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:22.816318035 CET	43928	443	192.168.2.23	91.189.91.42
Jan 13, 2025 23:27:23.017071962 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.021989107 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:23.022223949 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.024625063 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.029453039 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:23.029659986 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.034652948 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:23.114758968 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.119716883 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:23.119836092 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.121973991 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.126843929 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:23.126931906 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:23.131885052 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:24.616058111 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:24.616662979 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:24.621649981 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:24.763142109 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:24.763703108 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:24.768690109 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:25.623729944 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.628731012 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:25.628926039 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.631721020 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.636615038 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:25.636682034 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.641602039 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:25.770488977 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.775631905 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:25.775785923 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.778161049 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.783045053 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:25.783124924 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:25.788017988 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:27.262610912 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:27.263140917 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:27.268062115 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:28.268697023 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:28.273730993 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:28.273864031 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:28.276504993 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:28.281397104 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:28.281481981 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:28.286355972 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:29.890835047 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:29.891520023 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:29.896511078 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:30.896060944 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:30.900970936 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:30.901057959 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:30.901876926 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:30.906733990 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:30.906790972 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:30.911628008 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:32.518568039 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:32.519129992 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:32.524039030 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:33.525531054 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:33.530457973 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:33.530556917 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:33.532701969 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:33.537542105 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:33.537760973 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:33.542613983 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:35.156474113 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:35.156960964 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:35.161824942 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:35.787424088 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:35.792437077 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:36.163096905 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:36.168018103 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:36.168349028 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:36.170536041 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:36.175479889 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:36.175648928 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:36.180522919 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:37.811749935 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:37.812283039 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:37.817246914 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:38.819118977 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:38.824167967 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:38.824268103 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:38.826841116 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:38.831715107 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:38.831921101 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:38.836735964 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:39.290014982 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:39.290680885 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:39.295646906 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:40.297518015 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:40.302433968 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:40.302666903 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:40.304960966 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:40.309812069 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:40.310163975 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:40.315021992 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:40.449244976 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:40.449624062 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:40.454484940 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:41.456023932 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:41.461003065 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:41.461256027 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:41.463540077 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:41.468477011 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:41.468799114 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:41.473701954 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:41.963944912 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:41.964329004 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:41.969225883 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:42.967078924 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:42.971934080 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:42.972089052 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:42.973031044 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:42.977833033 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:42.977881908 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:42.982691050 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:43.062643051 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:43.063137054 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:43.068013906 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:44.069369078 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:44.074512959 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:44.074625969 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:44.076848030 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:44.081733942 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:44.081933022 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:44.086781025 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:44.589714050 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:44.590512037 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:44.595942020 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:45.595602989 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:45.602307081 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:45.602554083 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:45.604537010 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:45.610013008 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:45.610094070 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:45.615761042 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:45.703496933 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:45.703821898 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:45.709533930 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:46.707266092 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:46.712929010 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:46.713056087 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:46.714564085 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:46.720093966 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:46.720177889 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:46.725038052 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:47.231482029 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:47.232089043 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:47.237023115 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:48.238014936 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:48.243052006 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:48.243139029 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:48.245120049 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:48.250000954 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:48.250072002 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:48.255393028 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:49.871104956 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:49.871437073 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:49.876303911 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:50.761872053 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:50.762326002 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:50.767859936 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:50.873873949 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:50.879107952 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:50.879211903 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:50.880402088 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:50.885231972 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:50.885318041 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:50.890117884 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:51.766616106 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:51.772245884 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:51.772434950 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:51.774231911 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:51.779423952 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:51.779511929 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:51.784533978 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:52.476325035 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:52.476942062 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:52.482037067 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:53.368705034 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:53.369463921 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:53.374454975 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:53.481244087 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:53.486182928 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:53.486318111 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:53.488646984 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:53.493529081 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:53.493622065 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:53.498533964 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:54.374413967 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:54.379352093 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:54.379477024 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:54.382019997 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:54.386893988 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:54.387020111 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:54.391870975 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:55.136434078 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:55.136787891 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:55.141736031 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:56.005620956 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:56.006277084 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:56.011703014 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:56.140685081 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:56.145728111 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:56.145838976 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:56.147277117 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:56.152096987 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:56.152195930 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:56.157063961 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:57.011040926 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:57.015921116 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:57.016164064 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:57.018069029 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:57.022916079 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:57.022994995 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:57.027806044 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:57.773334026 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:57.773940086 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:57.778851032 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:58.748661995 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:58.749377012 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:58.754211903 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:58.777746916 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:58.782764912 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:58.782845974 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:58.785737038 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:58.790673971 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:58.790857077 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:58.795743942 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:59.756618977 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:59.762669086 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:59.762866974 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:59.765310049 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:59.770184994 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:27:59.770612955 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:27:59.775458097 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:00.382658958 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:00.383362055 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:00.388279915 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:01.386324883 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:01.386588097 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:01.390172005 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:01.391441107 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:01.394977093 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:01.395185947 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:01.397423983 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:01.402268887 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:01.402353048 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:01.407119036 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:02.393265963 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:02.398557901 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:02.398694992 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:02.400943995 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:02.405885935 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:02.405963898 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:02.410937071 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:03.034568071 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:03.035037041 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:03.039988041 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:04.012325048 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:04.012629032 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:04.017631054 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:04.038758039 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:04.045347929 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:04.045440912 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:04.047430038 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:04.052242041 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:04.052298069 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:04.057056904 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:05.015674114 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:05.020721912 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:05.020831108 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:05.022495985 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:05.027373075 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:05.027453899 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:05.032363892 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:05.731821060 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:05.732220888 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:05.737407923 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:06.738198996 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:06.743334055 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:06.743633032 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:06.746124983 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:06.750982046 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:06.751399040 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:06.756287098 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:08.371608973 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:08.372220993 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:08.377417088 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:09.378563881 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:09.383774042 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:09.383876085 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:09.386255980 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:09.391109943 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:09.391319990 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:09.397064924 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:13.435415983 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:13.436068058 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:13.441400051 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:14.442832947 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:14.448142052 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:14.448400974 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:14.450983047 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:14.455888033 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:14.456013918 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:14.460869074 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:16.075854063 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:16.076246977 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:16.081207991 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:17.082189083 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:17.087438107 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:17.087953091 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:17.089786053 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:17.094640017 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:17.094813108 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:17.099648952 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:18.606412888 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:18.606952906 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:18.611915112 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:18.694605112 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:18.695230007 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:18.700212955 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:19.613126993 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.618194103 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:19.618455887 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.620923996 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.625847101 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:19.625927925 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.630816936 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:19.699975014 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.704895973 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:19.705003977 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.707290888 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.712228060 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:19.712313890 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:19.717113018 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:21.376713991 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:21.377471924 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:21.382404089 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:21.468236923 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:21.468723059 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:21.473882914 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:22.383893967 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.389090061 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:22.389321089 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.391216993 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.396042109 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:22.396135092 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.400985003 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:22.473491907 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.478720903 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:22.478959084 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.481215954 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.486037016 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:22.486246109 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:22.491043091 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:24.015480042 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:24.016144037 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:24.021032095 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:24.107422113 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:24.108194113 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:24.113154888 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:25.021718025 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.026735067 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:25.026967049 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.029025078 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.036602020 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:25.036880970 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.041943073 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:25.114856005 CET	47692	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.120872974 CET	3778	47692	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:25.121022940 CET	47692	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.123229980 CET	47692	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.128856897 CET	3778	47692	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:25.129040956 CET	47692	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:25.134718895 CET	3778	47692	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:26.680321932 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:26.681013107 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:26.685980082 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:26.814349890 CET	3778	47692	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:26.814945936 CET	47692	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:26.820413113 CET	3778	47692	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:27.686770916 CET	47694	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.691823006 CET	3778	47694	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:27.691951990 CET	47694	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.694497108 CET	47694	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.699345112 CET	3778	47694	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:27.699614048 CET	47694	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.704437971 CET	3778	47694	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:27.820046902 CET	47696	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.828874111 CET	3778	47696	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:27.829096079 CET	47696	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.831711054 CET	47696	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.837852001 CET	3778	47696	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:27.838187933 CET	47696	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:27.843024015 CET	3778	47696	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:29.343899012 CET	3778	47694	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:29.344645023 CET	47694	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:29.349489927 CET	3778	47694	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:29.463725090 CET	3778	47696	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:29.464212894 CET	47696	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:29.469110012 CET	3778	47696	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:30.349556923 CET	47698	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.354409933 CET	3778	47698	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:30.354592085 CET	47698	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.356942892 CET	47698	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.361764908 CET	3778	47698	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:30.361836910 CET	47698	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.366687059 CET	3778	47698	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:30.469543934 CET	47700	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.474560022 CET	3778	47700	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:30.474678040 CET	47700	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.476921082 CET	47700	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.481703043 CET	3778	47700	154.213.187.11	192.168.2.23
Jan 13, 2025 23:28:30.481775045 CET	47700	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:28:30.486576080 CET	3778	47700	154.213.187.11	192.168.2.23

System Behavior

Analysis Process: camp.m68k.elf PID: 6261, Parent PID: 6184

General

Start time (UTC):	22:26:20
Start date (UTC):	13/01/2025
Path:	/tmp/camp.m68k.elf
Arguments:	/tmp/camp.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6263, Parent PID: 6261

General

Start time (UTC):	22:26:20
Start date (UTC):	13/01/2025
Path:	/tmp/camp.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6265, Parent PID: 6263

General

Start time (UTC):	22:26:20
Start date (UTC):	13/01/2025
Path:	/tmp/camp.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6267, Parent PID: 6263

General

Start time (UTC):	22:26:20
Start date (UTC):	13/01/2025
Path:	/tmp/camp.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6273, Parent PID: 6261

General

Start time (UTC):	22:26:27
Start date (UTC):	13/01/2025
Path:	/tmp/camp.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6274, Parent PID: 6261

General

Start time (UTC):	22:26:27
Start date (UTC):	13/01/2025
Path:	/tmp/camp.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report camp.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: camp.m68k.elf PID: 6261, Parent PID: 6184

General

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6263, Parent PID: 6261

General

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6265, Parent PID: 6263

General

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6267, Parent PID: 6263

General

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6273, Parent PID: 6261

General

Chronological Activities

Analysis Process: camp.m68k.elf PID: 6274, Parent PID: 6261

General

Chronological Activities

Linux Analysis Report
camp.m68k.elf