Edit tour

Linux Analysis Report
Kloki.arm5.elf

Overview

General Information

Sample name:	Kloki.arm5.elf
Analysis ID:	1594477
MD5:	58b81b44e5fb0065713e5e87584e6ee6
SHA1:	3241bb285157b8377b710fe618e54fb462c8f94f
SHA256:	20c9236bc4e53aeb80e2081170b8cec48a4ef684fa0533535566925cbd2f6b19
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Suricata IDS alerts with low severity for network traffic

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1594477
Start date and time:	2025-01-19 02:56:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Kloki.arm5.elf
Detection:	MAL
Classification:	mal60.spre.linELF@0/0@1/0

Runtime Messages

Command:	/tmp/Kloki.arm5.elf
PID:	6267
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	suka
Standard Error:

Process Tree

system is lnxubuntu20

Kloki.arm5.elf (PID: 6267, Parent: 6191, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Kloki.arm5.elf

Kloki.arm5.elf New Fork (PID: 6269, Parent: 6267)

Kloki.arm5.elf New Fork (PID: 6271, Parent: 6267)

Kloki.arm5.elf New Fork (PID: 6273, Parent: 6271)

gnome-session-binary New Fork (PID: 6294, Parent: 1477)

sh (PID: 6294, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6296, Parent: 1477)

sh (PID: 6296, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gnome-session-binary New Fork (PID: 6298, Parent: 1477)

sh (PID: 6298, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6301, Parent: 1477)

sh (PID: 6301, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6301, Parent: 1477, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 6302, Parent: 1320)

Default (PID: 6302, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6304, Parent: 1320)

Default (PID: 6304, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

cleanup

Suricata Signatures

ET COMPROMISED Known Compromised or Hostile Host Traffic group 18

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-19T02:57:15.023637+0100	2500034	2	Misc Attack	83.222.191.90	13566	192.168.2.23	42774	TCP

String: ppid/proc/net/tcp/proc/self/exe/proc//status/fd//dev/null/dev/consolesocket05/proc/%d/exepkillkillkillallechowgetcurlpsbusyboxiptablesrebootshutdownhaltpoweroffinitsystemctltelinitcatgrepshashbashzshcshkshdashfish

Source: global traffic	TCP traffic: 192.168.2.23:38230 -> 83.222.166.24:13566
Source: global traffic	TCP traffic: 192.168.2.23:59522 -> 83.222.82.194:13566
Source: global traffic	TCP traffic: 192.168.2.23:49096 -> 83.222.131.50:13566
Source: global traffic	TCP traffic: 192.168.2.23:45106 -> 83.222.255.35:13566
Source: global traffic	TCP traffic: 192.168.2.23:46492 -> 83.222.228.21:13566
Source: global traffic	TCP traffic: 192.168.2.23:40878 -> 83.222.185.252:13566
Source: global traffic	TCP traffic: 192.168.2.23:36060 -> 83.222.182.10:13566
Source: global traffic	TCP traffic: 192.168.2.23:44998 -> 83.222.190.71:13566
Source: global traffic	TCP traffic: 192.168.2.23:32888 -> 83.222.212.108:13566
Source: global traffic	TCP traffic: 192.168.2.23:53450 -> 83.222.34.19:13566
Source: global traffic	TCP traffic: 192.168.2.23:51404 -> 83.222.69.243:13566
Source: global traffic	TCP traffic: 192.168.2.23:40904 -> 83.222.56.203:13566
Source: global traffic	TCP traffic: 192.168.2.23:50686 -> 83.222.59.215:13566
Source: global traffic	TCP traffic: 192.168.2.23:39004 -> 83.222.240.144:13566
Source: global traffic	TCP traffic: 192.168.2.23:56230 -> 83.222.50.58:13566
Source: global traffic	TCP traffic: 192.168.2.23:55254 -> 83.222.31.216:13566
Source: global traffic	TCP traffic: 192.168.2.23:57560 -> 83.222.82.114:13566
Source: global traffic	TCP traffic: 192.168.2.23:41638 -> 83.222.154.213:13566
Source: global traffic	TCP traffic: 192.168.2.23:53926 -> 83.222.164.154:13566
Source: global traffic	TCP traffic: 192.168.2.23:55636 -> 83.222.249.136:13566
Source: global traffic	TCP traffic: 192.168.2.23:54108 -> 83.222.175.178:13566
Source: global traffic	TCP traffic: 192.168.2.23:59938 -> 83.222.133.102:13566
Source: global traffic	TCP traffic: 192.168.2.23:55280 -> 83.222.188.67:13566
Source: global traffic	TCP traffic: 192.168.2.23:42764 -> 83.222.173.145:13566
Source: global traffic	TCP traffic: 192.168.2.23:40214 -> 83.222.176.207:13566
Source: global traffic	TCP traffic: 192.168.2.23:47452 -> 83.222.164.245:13566
Source: global traffic	TCP traffic: 192.168.2.23:41774 -> 83.222.194.221:13566
Source: global traffic	TCP traffic: 192.168.2.23:60992 -> 83.222.192.254:13566
Source: global traffic	TCP traffic: 192.168.2.23:59066 -> 83.222.180.177:13566
Source: global traffic	TCP traffic: 192.168.2.23:58006 -> 83.222.142.230:13566
Source: global traffic	TCP traffic: 192.168.2.23:57958 -> 83.222.235.174:13566
Source: global traffic	TCP traffic: 192.168.2.23:59218 -> 83.222.190.61:13566
Source: global traffic	TCP traffic: 192.168.2.23:53422 -> 83.222.32.89:13566
Source: global traffic	TCP traffic: 192.168.2.23:36524 -> 83.222.19.196:13566
Source: global traffic	TCP traffic: 192.168.2.23:50648 -> 83.222.243.12:13566
Source: global traffic	TCP traffic: 192.168.2.23:41368 -> 83.222.77.162:13566
Source: global traffic	TCP traffic: 192.168.2.23:44552 -> 83.222.190.210:13566
Source: global traffic	TCP traffic: 192.168.2.23:35286 -> 83.222.8.122:13566
Source: global traffic	TCP traffic: 192.168.2.23:32978 -> 83.222.21.181:13566
Source: global traffic	TCP traffic: 192.168.2.23:47492 -> 83.222.11.197:13566
Source: global traffic	TCP traffic: 192.168.2.23:38668 -> 83.222.132.176:13566
Source: global traffic	TCP traffic: 192.168.2.23:34402 -> 83.222.186.71:13566
Source: global traffic	TCP traffic: 192.168.2.23:42906 -> 83.222.141.123:13566
Source: global traffic	TCP traffic: 192.168.2.23:41152 -> 83.222.69.65:13566
Source: global traffic	TCP traffic: 192.168.2.23:34468 -> 83.222.44.211:13566
Source: global traffic	TCP traffic: 192.168.2.23:36242 -> 83.222.40.23:13566
Source: global traffic	TCP traffic: 192.168.2.23:57522 -> 83.222.129.230:13566
Source: global traffic	TCP traffic: 192.168.2.23:36636 -> 83.222.84.161:13566
Source: global traffic	TCP traffic: 192.168.2.23:48836 -> 83.222.63.103:13566
Source: global traffic	TCP traffic: 192.168.2.23:57214 -> 83.222.102.50:13566
Source: global traffic	TCP traffic: 192.168.2.23:41438 -> 83.222.115.179:13566
Source: global traffic	TCP traffic: 192.168.2.23:49662 -> 83.222.213.49:13566
Source: global traffic	TCP traffic: 192.168.2.23:55626 -> 83.222.133.221:13566
Source: global traffic	TCP traffic: 192.168.2.23:52298 -> 83.222.172.154:13566
Source: global traffic	TCP traffic: 192.168.2.23:44314 -> 83.222.147.183:13566
Source: global traffic	TCP traffic: 192.168.2.23:37246 -> 83.222.96.23:13566
Source: global traffic	TCP traffic: 192.168.2.23:53368 -> 83.222.103.26:13566
Source: global traffic	TCP traffic: 192.168.2.23:51646 -> 83.222.94.244:13566
Source: global traffic	TCP traffic: 192.168.2.23:51590 -> 83.222.149.163:13566
Source: global traffic	TCP traffic: 192.168.2.23:37412 -> 83.222.54.193:13566
Source: global traffic	TCP traffic: 192.168.2.23:56356 -> 83.222.119.94:13566
Source: global traffic	TCP traffic: 192.168.2.23:51372 -> 83.222.216.248:13566
Source: global traffic	TCP traffic: 192.168.2.23:51340 -> 83.222.68.45:13566
Source: global traffic	TCP traffic: 192.168.2.23:55194 -> 83.222.154.132:13566
Source: global traffic	TCP traffic: 192.168.2.23:55892 -> 83.222.148.0:13566
Source: global traffic	TCP traffic: 192.168.2.23:41252 -> 83.222.182.8:13566
Source: global traffic	TCP traffic: 192.168.2.23:49808 -> 83.222.179.139:13566
Source: global traffic	TCP traffic: 192.168.2.23:57054 -> 83.222.57.56:13566
Source: global traffic	TCP traffic: 192.168.2.23:51772 -> 83.222.105.229:13566
Source: global traffic	TCP traffic: 192.168.2.23:36130 -> 83.222.210.252:13566
Source: global traffic	TCP traffic: 192.168.2.23:57896 -> 83.222.157.50:13566
Source: global traffic	TCP traffic: 192.168.2.23:42102 -> 83.222.19.4:13566
Source: global traffic	TCP traffic: 192.168.2.23:47828 -> 83.222.77.114:13566
Source: global traffic	TCP traffic: 192.168.2.23:41898 -> 83.222.249.226:13566
Source: global traffic	TCP traffic: 192.168.2.23:56328 -> 83.222.21.47:13566
Source: global traffic	TCP traffic: 192.168.2.23:56672 -> 83.222.164.140:13566
Source: global traffic	TCP traffic: 192.168.2.23:52336 -> 83.222.141.124:13566
Source: global traffic	TCP traffic: 192.168.2.23:59018 -> 83.222.133.209:13566
Source: global traffic	TCP traffic: 192.168.2.23:35638 -> 83.222.169.31:13566
Source: global traffic	TCP traffic: 192.168.2.23:52808 -> 83.222.85.62:13566
Source: global traffic	TCP traffic: 192.168.2.23:51148 -> 83.222.31.12:13566
Source: global traffic	TCP traffic: 192.168.2.23:39680 -> 83.222.70.210:13566
Source: global traffic	TCP traffic: 192.168.2.23:37208 -> 83.222.151.127:13566
Source: global traffic	TCP traffic: 192.168.2.23:55468 -> 83.222.10.0:13566
Source: global traffic	TCP traffic: 192.168.2.23:48026 -> 83.222.101.220:13566
Source: global traffic	TCP traffic: 192.168.2.23:53836 -> 83.222.252.2:13566
Source: global traffic	TCP traffic: 192.168.2.23:34610 -> 83.222.15.16:13566
Source: global traffic	TCP traffic: 192.168.2.23:45552 -> 83.222.6.92:13566
Source: global traffic	TCP traffic: 192.168.2.23:48656 -> 83.222.130.255:13566
Source: global traffic	TCP traffic: 192.168.2.23:40928 -> 83.222.62.151:13566
Source: global traffic	TCP traffic: 192.168.2.23:39644 -> 83.222.46.226:13566
Source: global traffic	TCP traffic: 192.168.2.23:56990 -> 83.222.36.187:13566
Source: global traffic	TCP traffic: 192.168.2.23:55972 -> 83.222.95.169:13566
Source: global traffic	TCP traffic: 192.168.2.23:54982 -> 83.222.141.8:13566
Source: global traffic	TCP traffic: 192.168.2.23:54506 -> 83.222.200.226:13566
Source: global traffic	TCP traffic: 192.168.2.23:52964 -> 83.222.70.231:13566
Source: global traffic	TCP traffic: 192.168.2.23:45506 -> 83.222.238.140:13566
Source: global traffic	TCP traffic: 192.168.2.23:46892 -> 83.222.185.134:13566
Source: global traffic	TCP traffic: 192.168.2.23:45912 -> 83.222.12.195:13566
Source: global traffic	TCP traffic: 192.168.2.23:43064 -> 83.222.134.113:13566
Source: global traffic	TCP traffic: 192.168.2.23:33594 -> 83.222.159.131:13566
Source: global traffic	TCP traffic: 192.168.2.23:54026 -> 83.222.115.174:13566
Source: global traffic	TCP traffic: 192.168.2.23:56678 -> 83.222.147.121:13566
Source: global traffic	TCP traffic: 192.168.2.23:33792 -> 83.222.10.21:13566
Source: global traffic	TCP traffic: 192.168.2.23:60184 -> 83.222.121.73:13566
Source: global traffic	TCP traffic: 192.168.2.23:43862 -> 83.222.172.167:13566
Source: global traffic	TCP traffic: 192.168.2.23:57224 -> 83.222.43.208:13566
Source: global traffic	TCP traffic: 192.168.2.23:50514 -> 83.222.99.138:13566
Source: global traffic	TCP traffic: 192.168.2.23:34914 -> 83.222.121.240:13566
Source: global traffic	TCP traffic: 192.168.2.23:49234 -> 83.222.147.65:13566
Source: global traffic	TCP traffic: 192.168.2.23:40832 -> 83.222.210.217:13566
Source: global traffic	TCP traffic: 192.168.2.23:44736 -> 83.222.40.193:13566
Source: global traffic	TCP traffic: 192.168.2.23:36200 -> 83.222.102.225:13566
Source: global traffic	TCP traffic: 192.168.2.23:42774 -> 83.222.191.90:13566

Source: /tmp/Kloki.arm5.elf (PID: 6267)

Socket: 127.0.0.1:14435

Jump to behavior

Source: Network traffic

Suricata IDS: 2500034 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 18 : 83.222.191.90:13566 -> 192.168.2.23:42774

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.166.24
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.82.194
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.166.24
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.82.194
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.131.50
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.131.50
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.131.50
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.255.35
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.131.50
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.255.35
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.255.35
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.255.35
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.228.21
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.228.21
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.185.252
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.182.10
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.190.71
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.185.252
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.212.108
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.182.10
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.190.71
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.212.108
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.212.108
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.34.19
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.212.108
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.69.243
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.56.203
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.34.19
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.69.243
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.56.203
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.59.215
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.59.215
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.240.144
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.240.144
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.50.58
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.31.216
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.50.58
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.82.114
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.31.216
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.154.213
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.82.114
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.154.213
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.164.154
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.249.136
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.175.178
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.133.102
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.164.154
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.188.67

Source: global traffic

DNS traffic detected: DNS query: secure-network-rebirthltd.ru

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1532, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1622, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1633, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 2146, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6296, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6298, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: ppid/proc/net/tcp/proc/self/exe/proc//status/fd//dev/null/dev/consolesocket05/proc/%d/exepkillkillkillallechowgetcurlpsbusyboxiptablesrebootshutdownhaltpoweroffinitsystemctltelinitcatgrepshashbashzshcshkshdashfish

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1532, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1622, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1633, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 2146, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6296, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6298, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior
Source: /tmp/Kloki.arm5.elf (PID: 6273)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.linELF@0/0@1/0

Source: /tmp/Kloki.arm5.elf (PID: 6267)

Queries kernel information via 'uname':

Jump to behavior

Source: Kloki.arm5.elf, 6267.1.0000563bb74f4000.0000563bb7669000.rw-.sdmp, Kloki.arm5.elf, 6269.1.0000563bb74f4000.0000563bb7622000.rw-.sdmp	Binary or memory string: ;V!/etc/qemu-binfmt/arm
Source: Kloki.arm5.elf, 6267.1.00007ffc89397000.00007ffc893b8000.rw-.sdmp, Kloki.arm5.elf, 6269.1.00007ffc89397000.00007ffc893b8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Kloki.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Kloki.arm5.elf
Source: Kloki.arm5.elf, 6267.1.0000563bb74f4000.0000563bb7669000.rw-.sdmp, Kloki.arm5.elf, 6269.1.0000563bb74f4000.0000563bb7622000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Kloki.arm5.elf, 6267.1.00007ffc89397000.00007ffc893b8000.rw-.sdmp, Kloki.arm5.elf, 6269.1.00007ffc89397000.00007ffc893b8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Kloki.arm5.elf	38%	Virustotal		Browse
Kloki.arm5.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
Kloki.arm5.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
secure-network-rebirthltd.ru	83.222.191.90	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
83.222.121.73	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.147.65	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.70.231	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.172.167	unknown	Bulgaria	49040	KIG-UNISAT-TVBG	false
83.222.59.215	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.194.221	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.10.21	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.166.24	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.11.197	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.190.210	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.147.121	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.115.174	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.129.230	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.69.65	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.115.179	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.54.193	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.159.131	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.249.226	unknown	United Kingdom	13768	COGECO-PEER1CA	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
83.222.212.108	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.228.21	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.19.4	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.46.226	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.21.47	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.96.23	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.188.67	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.238.140	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.216.248	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.243.12	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.133.221	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.15.16	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.133.102	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.6.92	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.102.225	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.70.210	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.40.193	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.103.26	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.21.181	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.94.244	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.69.243	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.255.35	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.102.50	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.95.169	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.147.183	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.151.127	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.57.56	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.44.211	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.173.145	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.154.132	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.131.50	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.252.2	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.134.113	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.210.217	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.180.177	unknown	Bulgaria	205872	EXTRANET-ASBG	false
83.222.99.138	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.191.90	secure-network-rebirthltd.ru	Bulgaria	43561	NET1-ASBG	false
83.222.130.255	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.192.254	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.133.209	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.176.207	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.68.45	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.77.114	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.36.187	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.213.49	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.56.203	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.85.62	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.186.71	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.175.178	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.240.144	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.132.176	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.121.240	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.164.245	unknown	Bulgaria	31037	WAVENETLB	false
83.222.32.89	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.31.216	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.62.151	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.19.196	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.149.163	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.40.23	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.142.230	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.101.220	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.12.195	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.63.103	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.182.10	unknown	Bulgaria	205872	EXTRANET-ASBG	false
83.222.200.226	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.141.124	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.141.123	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.164.140	unknown	Bulgaria	31037	WAVENETLB	false
83.222.190.61	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.141.8	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.84.161	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.119.94	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.169.31	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.190.71	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.77.162	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.179.139	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.50.58	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.105.229	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.43.208	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.31.12	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.222.129.230	Kloki.spc.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
secure-network-rebirthltd.ru	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	loki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.i686.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.arm4.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.191.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.84.27
	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.84.226
	loki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.82.223
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.89.99
	Kloki.i686.elf	Get hash	malicious	Unknown	Browse	83.222.78.125
	loki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.88.209
	loki.arm4.elf	Get hash	malicious	Unknown	Browse	83.222.84.140
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.84.140
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.93.197
	loki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.90.26
MNOGOBYTE-ASMoscowRussiaRU	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.112.215
	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.110.25
	loki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.101.228
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.107.141
	Kloki.i686.elf	Get hash	malicious	Unknown	Browse	83.222.109.253
	loki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.112.175
	loki.arm4.elf	Get hash	malicious	Unknown	Browse	83.222.122.108
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.122.108
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.102.216
	loki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.101.249
SENSELAN-ASsenseLANGmbHCH	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.134.38
	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.139.96
	loki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.159.161
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.156.89
	Kloki.i686.elf	Get hash	malicious	Unknown	Browse	83.222.142.101
	loki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.128.163
	loki.arm4.elf	Get hash	malicious	Unknown	Browse	83.222.143.214
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.143.214
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.157.43
	loki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.135.133
KIG-UNISAT-TVBG	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.170.59
	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.170.166
	loki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.170.135
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.160.95
	Kloki.i686.elf	Get hash	malicious	Unknown	Browse	83.222.172.90
	loki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.170.78
	loki.arm4.elf	Get hash	malicious	Unknown	Browse	83.222.172.4
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.172.4
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.170.184
	loki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.172.26

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.080237233317122
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Kloki.arm5.elf
File size:	63'260 bytes
MD5:	58b81b44e5fb0065713e5e87584e6ee6
SHA1:	3241bb285157b8377b710fe618e54fb462c8f94f
SHA256:	20c9236bc4e53aeb80e2081170b8cec48a4ef684fa0533535566925cbd2f6b19
SHA512:	8391530a13432ecd1843e7fa666605ea471282e3d69a7f23af0ec6ab4e3e2b2780d8b429b50323ea61187aa46913818c54adad1bed8a2c5f1805bcee6e6947a9
SSDEEP:	768:W5PQmtMHSXYGNvICYMOko0HrFRVCXSo6ub4oUHN9uPPQDmMdJZcbGuvD+sSO1Cfi:Y4muHMYMJHhRVCXSo9TszmHvDsOsXL
TLSH:	27532A91FC815A13C5D422B7FB6E428C372723B8D2EE7213AD265F11778A92B0E77641
File Content Preview:	.ELF...a..........(.........4...........4. ...(..........................................................5..........Q.td..................................-...L."...h7..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	62860
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xddd8	0x0	0x6	AX	16
.fini	PROGBITS	0x15e88	0xde88	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x15e9c	0xde9c	0x1320	0x0	0x2	A	4
.ctors	PROGBITS	0x1f1c0	0xf1c0	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1f1c8	0xf1c8	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1f1d4	0xf1d4	0x378	0x0	0x3	WA	4
.bss	NOBITS	0x1f54c	0xf54c	0x3174	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf54c	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xf1bc	0xf1bc	6.1144	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xf1c0	0x1f1c0	0x1f1c0	0x38c	0x3500	2.8186	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-19T02:57:15.023637+0100	2500034	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18	2	83.222.191.90	13566	192.168.2.23	42774	TCP

Network Port Distribution

Total Packets: 278
• 13566 undefined
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2025 02:57:13.294136047 CET	42516	80	192.168.2.23	109.202.202.202
Jan 19, 2025 02:57:13.294141054 CET	43928	443	192.168.2.23	91.189.91.42
Jan 19, 2025 02:57:14.231132030 CET	38230	13566	192.168.2.23	83.222.166.24
Jan 19, 2025 02:57:14.232171059 CET	59522	13566	192.168.2.23	83.222.82.194
Jan 19, 2025 02:57:14.236047029 CET	13566	38230	83.222.166.24	192.168.2.23
Jan 19, 2025 02:57:14.236109018 CET	38230	13566	192.168.2.23	83.222.166.24
Jan 19, 2025 02:57:14.237113953 CET	13566	59522	83.222.82.194	192.168.2.23
Jan 19, 2025 02:57:14.237158060 CET	59522	13566	192.168.2.23	83.222.82.194
Jan 19, 2025 02:57:14.252296925 CET	49096	13566	192.168.2.23	83.222.131.50
Jan 19, 2025 02:57:14.257317066 CET	13566	49096	83.222.131.50	192.168.2.23
Jan 19, 2025 02:57:14.257381916 CET	49096	13566	192.168.2.23	83.222.131.50
Jan 19, 2025 02:57:14.273642063 CET	49096	13566	192.168.2.23	83.222.131.50
Jan 19, 2025 02:57:14.275856972 CET	45106	13566	192.168.2.23	83.222.255.35
Jan 19, 2025 02:57:14.278610945 CET	13566	49096	83.222.131.50	192.168.2.23
Jan 19, 2025 02:57:14.278662920 CET	49096	13566	192.168.2.23	83.222.131.50
Jan 19, 2025 02:57:14.280802965 CET	13566	45106	83.222.255.35	192.168.2.23
Jan 19, 2025 02:57:14.280967951 CET	45106	13566	192.168.2.23	83.222.255.35
Jan 19, 2025 02:57:14.294826984 CET	45106	13566	192.168.2.23	83.222.255.35
Jan 19, 2025 02:57:14.299766064 CET	13566	45106	83.222.255.35	192.168.2.23
Jan 19, 2025 02:57:14.300090075 CET	45106	13566	192.168.2.23	83.222.255.35
Jan 19, 2025 02:57:14.300379992 CET	46492	13566	192.168.2.23	83.222.228.21
Jan 19, 2025 02:57:14.305201054 CET	13566	46492	83.222.228.21	192.168.2.23
Jan 19, 2025 02:57:14.305293083 CET	46492	13566	192.168.2.23	83.222.228.21
Jan 19, 2025 02:57:14.307157040 CET	40878	13566	192.168.2.23	83.222.185.252
Jan 19, 2025 02:57:14.309756994 CET	36060	13566	192.168.2.23	83.222.182.10
Jan 19, 2025 02:57:14.311616898 CET	44998	13566	192.168.2.23	83.222.190.71
Jan 19, 2025 02:57:14.311971903 CET	13566	40878	83.222.185.252	192.168.2.23
Jan 19, 2025 02:57:14.312027931 CET	40878	13566	192.168.2.23	83.222.185.252
Jan 19, 2025 02:57:14.313035011 CET	32888	13566	192.168.2.23	83.222.212.108
Jan 19, 2025 02:57:14.314647913 CET	13566	36060	83.222.182.10	192.168.2.23
Jan 19, 2025 02:57:14.314692020 CET	36060	13566	192.168.2.23	83.222.182.10
Jan 19, 2025 02:57:14.316489935 CET	13566	44998	83.222.190.71	192.168.2.23
Jan 19, 2025 02:57:14.316744089 CET	44998	13566	192.168.2.23	83.222.190.71
Jan 19, 2025 02:57:14.317837954 CET	13566	32888	83.222.212.108	192.168.2.23
Jan 19, 2025 02:57:14.317940950 CET	32888	13566	192.168.2.23	83.222.212.108
Jan 19, 2025 02:57:14.329747915 CET	32888	13566	192.168.2.23	83.222.212.108
Jan 19, 2025 02:57:14.333374023 CET	53450	13566	192.168.2.23	83.222.34.19
Jan 19, 2025 02:57:14.334640980 CET	13566	32888	83.222.212.108	192.168.2.23
Jan 19, 2025 02:57:14.334686995 CET	32888	13566	192.168.2.23	83.222.212.108
Jan 19, 2025 02:57:14.335177898 CET	51404	13566	192.168.2.23	83.222.69.243
Jan 19, 2025 02:57:14.336684942 CET	40904	13566	192.168.2.23	83.222.56.203
Jan 19, 2025 02:57:14.338294983 CET	13566	53450	83.222.34.19	192.168.2.23
Jan 19, 2025 02:57:14.338387012 CET	53450	13566	192.168.2.23	83.222.34.19
Jan 19, 2025 02:57:14.339982033 CET	13566	51404	83.222.69.243	192.168.2.23
Jan 19, 2025 02:57:14.340039968 CET	51404	13566	192.168.2.23	83.222.69.243
Jan 19, 2025 02:57:14.341521978 CET	13566	40904	83.222.56.203	192.168.2.23
Jan 19, 2025 02:57:14.341578960 CET	40904	13566	192.168.2.23	83.222.56.203
Jan 19, 2025 02:57:14.353944063 CET	50686	13566	192.168.2.23	83.222.59.215
Jan 19, 2025 02:57:14.358860016 CET	13566	50686	83.222.59.215	192.168.2.23
Jan 19, 2025 02:57:14.358953953 CET	50686	13566	192.168.2.23	83.222.59.215
Jan 19, 2025 02:57:14.395745993 CET	39004	13566	192.168.2.23	83.222.240.144
Jan 19, 2025 02:57:14.400630951 CET	13566	39004	83.222.240.144	192.168.2.23
Jan 19, 2025 02:57:14.400686026 CET	39004	13566	192.168.2.23	83.222.240.144
Jan 19, 2025 02:57:14.407689095 CET	56230	13566	192.168.2.23	83.222.50.58
Jan 19, 2025 02:57:14.411561966 CET	55254	13566	192.168.2.23	83.222.31.216
Jan 19, 2025 02:57:14.412815094 CET	13566	56230	83.222.50.58	192.168.2.23
Jan 19, 2025 02:57:14.412859917 CET	56230	13566	192.168.2.23	83.222.50.58
Jan 19, 2025 02:57:14.415482044 CET	57560	13566	192.168.2.23	83.222.82.114
Jan 19, 2025 02:57:14.416527987 CET	13566	55254	83.222.31.216	192.168.2.23
Jan 19, 2025 02:57:14.416569948 CET	55254	13566	192.168.2.23	83.222.31.216
Jan 19, 2025 02:57:14.417889118 CET	41638	13566	192.168.2.23	83.222.154.213
Jan 19, 2025 02:57:14.420275927 CET	13566	57560	83.222.82.114	192.168.2.23
Jan 19, 2025 02:57:14.420321941 CET	57560	13566	192.168.2.23	83.222.82.114
Jan 19, 2025 02:57:14.422679901 CET	13566	41638	83.222.154.213	192.168.2.23
Jan 19, 2025 02:57:14.422751904 CET	41638	13566	192.168.2.23	83.222.154.213
Jan 19, 2025 02:57:14.423666000 CET	53926	13566	192.168.2.23	83.222.164.154
Jan 19, 2025 02:57:14.424774885 CET	55636	13566	192.168.2.23	83.222.249.136
Jan 19, 2025 02:57:14.425436974 CET	54108	13566	192.168.2.23	83.222.175.178
Jan 19, 2025 02:57:14.427359104 CET	59938	13566	192.168.2.23	83.222.133.102
Jan 19, 2025 02:57:14.428486109 CET	13566	53926	83.222.164.154	192.168.2.23
Jan 19, 2025 02:57:14.428529978 CET	53926	13566	192.168.2.23	83.222.164.154
Jan 19, 2025 02:57:14.429126024 CET	55280	13566	192.168.2.23	83.222.188.67
Jan 19, 2025 02:57:14.429631948 CET	13566	55636	83.222.249.136	192.168.2.23
Jan 19, 2025 02:57:14.429687977 CET	55636	13566	192.168.2.23	83.222.249.136
Jan 19, 2025 02:57:14.430233955 CET	13566	54108	83.222.175.178	192.168.2.23
Jan 19, 2025 02:57:14.430273056 CET	54108	13566	192.168.2.23	83.222.175.178
Jan 19, 2025 02:57:14.432204008 CET	13566	59938	83.222.133.102	192.168.2.23
Jan 19, 2025 02:57:14.432259083 CET	59938	13566	192.168.2.23	83.222.133.102
Jan 19, 2025 02:57:14.433856010 CET	13566	55280	83.222.188.67	192.168.2.23
Jan 19, 2025 02:57:14.433890104 CET	55280	13566	192.168.2.23	83.222.188.67
Jan 19, 2025 02:57:14.434746981 CET	42764	13566	192.168.2.23	83.222.173.145
Jan 19, 2025 02:57:14.437164068 CET	40214	13566	192.168.2.23	83.222.176.207
Jan 19, 2025 02:57:14.437969923 CET	47452	13566	192.168.2.23	83.222.164.245
Jan 19, 2025 02:57:14.438754082 CET	41774	13566	192.168.2.23	83.222.194.221
Jan 19, 2025 02:57:14.439861059 CET	13566	42764	83.222.173.145	192.168.2.23
Jan 19, 2025 02:57:14.439933062 CET	42764	13566	192.168.2.23	83.222.173.145
Jan 19, 2025 02:57:14.439965963 CET	60992	13566	192.168.2.23	83.222.192.254
Jan 19, 2025 02:57:14.440814018 CET	59066	13566	192.168.2.23	83.222.180.177
Jan 19, 2025 02:57:14.442071915 CET	13566	40214	83.222.176.207	192.168.2.23
Jan 19, 2025 02:57:14.442176104 CET	40214	13566	192.168.2.23	83.222.176.207
Jan 19, 2025 02:57:14.442774057 CET	13566	47452	83.222.164.245	192.168.2.23
Jan 19, 2025 02:57:14.442835093 CET	47452	13566	192.168.2.23	83.222.164.245
Jan 19, 2025 02:57:14.443597078 CET	13566	41774	83.222.194.221	192.168.2.23
Jan 19, 2025 02:57:14.443634987 CET	41774	13566	192.168.2.23	83.222.194.221
Jan 19, 2025 02:57:14.444792032 CET	13566	60992	83.222.192.254	192.168.2.23
Jan 19, 2025 02:57:14.444839954 CET	60992	13566	192.168.2.23	83.222.192.254
Jan 19, 2025 02:57:14.445655107 CET	13566	59066	83.222.180.177	192.168.2.23
Jan 19, 2025 02:57:14.445703030 CET	59066	13566	192.168.2.23	83.222.180.177
Jan 19, 2025 02:57:14.461374998 CET	59066	13566	192.168.2.23	83.222.180.177
Jan 19, 2025 02:57:14.461832047 CET	58006	13566	192.168.2.23	83.222.142.230
Jan 19, 2025 02:57:14.462939024 CET	57958	13566	192.168.2.23	83.222.235.174
Jan 19, 2025 02:57:14.463779926 CET	59218	13566	192.168.2.23	83.222.190.61
Jan 19, 2025 02:57:14.464356899 CET	53422	13566	192.168.2.23	83.222.32.89
Jan 19, 2025 02:57:14.466475010 CET	13566	59066	83.222.180.177	192.168.2.23
Jan 19, 2025 02:57:14.466522932 CET	59066	13566	192.168.2.23	83.222.180.177
Jan 19, 2025 02:57:14.469007015 CET	13566	58006	83.222.142.230	192.168.2.23
Jan 19, 2025 02:57:14.469065905 CET	58006	13566	192.168.2.23	83.222.142.230
Jan 19, 2025 02:57:14.469077110 CET	13566	57958	83.222.235.174	192.168.2.23
Jan 19, 2025 02:57:14.469106913 CET	13566	59218	83.222.190.61	192.168.2.23
Jan 19, 2025 02:57:14.469141006 CET	59218	13566	192.168.2.23	83.222.190.61
Jan 19, 2025 02:57:14.469141006 CET	57958	13566	192.168.2.23	83.222.235.174
Jan 19, 2025 02:57:14.469193935 CET	13566	53422	83.222.32.89	192.168.2.23
Jan 19, 2025 02:57:14.469244003 CET	53422	13566	192.168.2.23	83.222.32.89
Jan 19, 2025 02:57:14.490888119 CET	53422	13566	192.168.2.23	83.222.32.89
Jan 19, 2025 02:57:14.491405010 CET	36524	13566	192.168.2.23	83.222.19.196
Jan 19, 2025 02:57:14.492177963 CET	50648	13566	192.168.2.23	83.222.243.12
Jan 19, 2025 02:57:14.492908955 CET	41368	13566	192.168.2.23	83.222.77.162
Jan 19, 2025 02:57:14.493654966 CET	44552	13566	192.168.2.23	83.222.190.210
Jan 19, 2025 02:57:14.494507074 CET	35286	13566	192.168.2.23	83.222.8.122
Jan 19, 2025 02:57:14.495327950 CET	32978	13566	192.168.2.23	83.222.21.181
Jan 19, 2025 02:57:14.496033907 CET	13566	53422	83.222.32.89	192.168.2.23
Jan 19, 2025 02:57:14.496118069 CET	53422	13566	192.168.2.23	83.222.32.89
Jan 19, 2025 02:57:14.496284008 CET	13566	36524	83.222.19.196	192.168.2.23
Jan 19, 2025 02:57:14.496366024 CET	36524	13566	192.168.2.23	83.222.19.196
Jan 19, 2025 02:57:14.497219086 CET	13566	50648	83.222.243.12	192.168.2.23
Jan 19, 2025 02:57:14.497281075 CET	50648	13566	192.168.2.23	83.222.243.12
Jan 19, 2025 02:57:14.497718096 CET	13566	41368	83.222.77.162	192.168.2.23
Jan 19, 2025 02:57:14.497766972 CET	41368	13566	192.168.2.23	83.222.77.162
Jan 19, 2025 02:57:14.498512983 CET	13566	44552	83.222.190.210	192.168.2.23
Jan 19, 2025 02:57:14.498558998 CET	44552	13566	192.168.2.23	83.222.190.210
Jan 19, 2025 02:57:14.499114037 CET	47492	13566	192.168.2.23	83.222.11.197
Jan 19, 2025 02:57:14.500324011 CET	13566	35286	83.222.8.122	192.168.2.23
Jan 19, 2025 02:57:14.500371933 CET	35286	13566	192.168.2.23	83.222.8.122
Jan 19, 2025 02:57:14.500418901 CET	38668	13566	192.168.2.23	83.222.132.176
Jan 19, 2025 02:57:14.501533031 CET	34402	13566	192.168.2.23	83.222.186.71
Jan 19, 2025 02:57:14.501758099 CET	13566	32978	83.222.21.181	192.168.2.23
Jan 19, 2025 02:57:14.501811981 CET	32978	13566	192.168.2.23	83.222.21.181
Jan 19, 2025 02:57:14.503968000 CET	13566	47492	83.222.11.197	192.168.2.23
Jan 19, 2025 02:57:14.504034996 CET	47492	13566	192.168.2.23	83.222.11.197
Jan 19, 2025 02:57:14.504054070 CET	42906	13566	192.168.2.23	83.222.141.123
Jan 19, 2025 02:57:14.505356073 CET	41152	13566	192.168.2.23	83.222.69.65
Jan 19, 2025 02:57:14.505445957 CET	13566	38668	83.222.132.176	192.168.2.23
Jan 19, 2025 02:57:14.505490065 CET	38668	13566	192.168.2.23	83.222.132.176
Jan 19, 2025 02:57:14.506413937 CET	34468	13566	192.168.2.23	83.222.44.211
Jan 19, 2025 02:57:14.506495953 CET	13566	34402	83.222.186.71	192.168.2.23
Jan 19, 2025 02:57:14.506536961 CET	34402	13566	192.168.2.23	83.222.186.71
Jan 19, 2025 02:57:14.507698059 CET	36242	13566	192.168.2.23	83.222.40.23
Jan 19, 2025 02:57:14.508900881 CET	13566	42906	83.222.141.123	192.168.2.23
Jan 19, 2025 02:57:14.508949995 CET	42906	13566	192.168.2.23	83.222.141.123
Jan 19, 2025 02:57:14.510190964 CET	13566	41152	83.222.69.65	192.168.2.23
Jan 19, 2025 02:57:14.510241032 CET	41152	13566	192.168.2.23	83.222.69.65
Jan 19, 2025 02:57:14.511023045 CET	57522	13566	192.168.2.23	83.222.129.230
Jan 19, 2025 02:57:14.511284113 CET	13566	34468	83.222.44.211	192.168.2.23
Jan 19, 2025 02:57:14.511334896 CET	34468	13566	192.168.2.23	83.222.44.211
Jan 19, 2025 02:57:14.512392044 CET	36636	13566	192.168.2.23	83.222.84.161
Jan 19, 2025 02:57:14.512551069 CET	13566	36242	83.222.40.23	192.168.2.23
Jan 19, 2025 02:57:14.512593031 CET	36242	13566	192.168.2.23	83.222.40.23
Jan 19, 2025 02:57:14.515786886 CET	48836	13566	192.168.2.23	83.222.63.103
Jan 19, 2025 02:57:14.516052008 CET	13566	57522	83.222.129.230	192.168.2.23
Jan 19, 2025 02:57:14.516103029 CET	57522	13566	192.168.2.23	83.222.129.230
Jan 19, 2025 02:57:14.517172098 CET	13566	36636	83.222.84.161	192.168.2.23
Jan 19, 2025 02:57:14.517232895 CET	36636	13566	192.168.2.23	83.222.84.161
Jan 19, 2025 02:57:14.517426014 CET	57214	13566	192.168.2.23	83.222.102.50
Jan 19, 2025 02:57:14.519830942 CET	41438	13566	192.168.2.23	83.222.115.179
Jan 19, 2025 02:57:14.520610094 CET	13566	48836	83.222.63.103	192.168.2.23
Jan 19, 2025 02:57:14.520653009 CET	48836	13566	192.168.2.23	83.222.63.103
Jan 19, 2025 02:57:14.521497965 CET	49662	13566	192.168.2.23	83.222.213.49
Jan 19, 2025 02:57:14.522248983 CET	13566	57214	83.222.102.50	192.168.2.23
Jan 19, 2025 02:57:14.522298098 CET	57214	13566	192.168.2.23	83.222.102.50
Jan 19, 2025 02:57:14.523267984 CET	55626	13566	192.168.2.23	83.222.133.221
Jan 19, 2025 02:57:14.524271011 CET	52298	13566	192.168.2.23	83.222.172.154
Jan 19, 2025 02:57:14.524753094 CET	13566	41438	83.222.115.179	192.168.2.23
Jan 19, 2025 02:57:14.524806023 CET	41438	13566	192.168.2.23	83.222.115.179
Jan 19, 2025 02:57:14.525324106 CET	44314	13566	192.168.2.23	83.222.147.183
Jan 19, 2025 02:57:14.526360989 CET	13566	49662	83.222.213.49	192.168.2.23
Jan 19, 2025 02:57:14.526393890 CET	37246	13566	192.168.2.23	83.222.96.23
Jan 19, 2025 02:57:14.526468039 CET	49662	13566	192.168.2.23	83.222.213.49
Jan 19, 2025 02:57:14.527421951 CET	53368	13566	192.168.2.23	83.222.103.26
Jan 19, 2025 02:57:14.528193951 CET	13566	55626	83.222.133.221	192.168.2.23
Jan 19, 2025 02:57:14.528244019 CET	55626	13566	192.168.2.23	83.222.133.221
Jan 19, 2025 02:57:14.528376102 CET	51646	13566	192.168.2.23	83.222.94.244
Jan 19, 2025 02:57:14.529093981 CET	13566	52298	83.222.172.154	192.168.2.23
Jan 19, 2025 02:57:14.529228926 CET	52298	13566	192.168.2.23	83.222.172.154
Jan 19, 2025 02:57:14.529807091 CET	51590	13566	192.168.2.23	83.222.149.163
Jan 19, 2025 02:57:14.530107975 CET	13566	44314	83.222.147.183	192.168.2.23
Jan 19, 2025 02:57:14.530164003 CET	44314	13566	192.168.2.23	83.222.147.183
Jan 19, 2025 02:57:14.531068087 CET	37412	13566	192.168.2.23	83.222.54.193
Jan 19, 2025 02:57:14.531267881 CET	13566	37246	83.222.96.23	192.168.2.23
Jan 19, 2025 02:57:14.531307936 CET	37246	13566	192.168.2.23	83.222.96.23
Jan 19, 2025 02:57:14.532099009 CET	56356	13566	192.168.2.23	83.222.119.94
Jan 19, 2025 02:57:14.532299042 CET	13566	53368	83.222.103.26	192.168.2.23
Jan 19, 2025 02:57:14.532351017 CET	53368	13566	192.168.2.23	83.222.103.26
Jan 19, 2025 02:57:14.532994032 CET	51372	13566	192.168.2.23	83.222.216.248
Jan 19, 2025 02:57:14.533170938 CET	13566	51646	83.222.94.244	192.168.2.23
Jan 19, 2025 02:57:14.533221960 CET	51646	13566	192.168.2.23	83.222.94.244
Jan 19, 2025 02:57:14.534634113 CET	13566	51590	83.222.149.163	192.168.2.23
Jan 19, 2025 02:57:14.534691095 CET	51590	13566	192.168.2.23	83.222.149.163
Jan 19, 2025 02:57:14.535916090 CET	13566	37412	83.222.54.193	192.168.2.23
Jan 19, 2025 02:57:14.535967112 CET	37412	13566	192.168.2.23	83.222.54.193
Jan 19, 2025 02:57:14.536915064 CET	13566	56356	83.222.119.94	192.168.2.23
Jan 19, 2025 02:57:14.536977053 CET	56356	13566	192.168.2.23	83.222.119.94
Jan 19, 2025 02:57:14.537782907 CET	13566	51372	83.222.216.248	192.168.2.23
Jan 19, 2025 02:57:14.537838936 CET	51372	13566	192.168.2.23	83.222.216.248
Jan 19, 2025 02:57:14.553920031 CET	51372	13566	192.168.2.23	83.222.216.248
Jan 19, 2025 02:57:14.557766914 CET	51340	13566	192.168.2.23	83.222.68.45
Jan 19, 2025 02:57:14.558963060 CET	13566	51372	83.222.216.248	192.168.2.23
Jan 19, 2025 02:57:14.559027910 CET	51372	13566	192.168.2.23	83.222.216.248
Jan 19, 2025 02:57:14.562788963 CET	13566	51340	83.222.68.45	192.168.2.23
Jan 19, 2025 02:57:14.562849998 CET	51340	13566	192.168.2.23	83.222.68.45
Jan 19, 2025 02:57:14.562922001 CET	55194	13566	192.168.2.23	83.222.154.132
Jan 19, 2025 02:57:14.567789078 CET	13566	55194	83.222.154.132	192.168.2.23
Jan 19, 2025 02:57:14.567854881 CET	55194	13566	192.168.2.23	83.222.154.132
Jan 19, 2025 02:57:14.570071936 CET	55194	13566	192.168.2.23	83.222.154.132
Jan 19, 2025 02:57:14.570472956 CET	55892	13566	192.168.2.23	83.222.148.0
Jan 19, 2025 02:57:14.571440935 CET	41252	13566	192.168.2.23	83.222.182.8
Jan 19, 2025 02:57:14.574609995 CET	49808	13566	192.168.2.23	83.222.179.139
Jan 19, 2025 02:57:14.574987888 CET	13566	55194	83.222.154.132	192.168.2.23
Jan 19, 2025 02:57:14.575036049 CET	55194	13566	192.168.2.23	83.222.154.132
Jan 19, 2025 02:57:14.575376034 CET	13566	55892	83.222.148.0	192.168.2.23
Jan 19, 2025 02:57:14.575452089 CET	55892	13566	192.168.2.23	83.222.148.0
Jan 19, 2025 02:57:14.576364040 CET	13566	41252	83.222.182.8	192.168.2.23
Jan 19, 2025 02:57:14.576417923 CET	41252	13566	192.168.2.23	83.222.182.8
Jan 19, 2025 02:57:14.579643965 CET	13566	49808	83.222.179.139	192.168.2.23
Jan 19, 2025 02:57:14.579700947 CET	49808	13566	192.168.2.23	83.222.179.139
Jan 19, 2025 02:57:14.579762936 CET	57054	13566	192.168.2.23	83.222.57.56
Jan 19, 2025 02:57:14.584944963 CET	13566	57054	83.222.57.56	192.168.2.23
Jan 19, 2025 02:57:14.584999084 CET	57054	13566	192.168.2.23	83.222.57.56
Jan 19, 2025 02:57:14.586179018 CET	51772	13566	192.168.2.23	83.222.105.229
Jan 19, 2025 02:57:14.591609001 CET	13566	51772	83.222.105.229	192.168.2.23
Jan 19, 2025 02:57:14.591675997 CET	51772	13566	192.168.2.23	83.222.105.229
Jan 19, 2025 02:57:14.603689909 CET	51772	13566	192.168.2.23	83.222.105.229
Jan 19, 2025 02:57:14.608711004 CET	13566	51772	83.222.105.229	192.168.2.23
Jan 19, 2025 02:57:14.608756065 CET	51772	13566	192.168.2.23	83.222.105.229
Jan 19, 2025 02:57:14.614584923 CET	36130	13566	192.168.2.23	83.222.210.252
Jan 19, 2025 02:57:14.619519949 CET	13566	36130	83.222.210.252	192.168.2.23
Jan 19, 2025 02:57:14.619617939 CET	36130	13566	192.168.2.23	83.222.210.252
Jan 19, 2025 02:57:14.639244080 CET	36130	13566	192.168.2.23	83.222.210.252
Jan 19, 2025 02:57:14.644294977 CET	13566	36130	83.222.210.252	192.168.2.23
Jan 19, 2025 02:57:14.644387960 CET	36130	13566	192.168.2.23	83.222.210.252
Jan 19, 2025 02:57:14.650594950 CET	57896	13566	192.168.2.23	83.222.157.50
Jan 19, 2025 02:57:14.655652046 CET	13566	57896	83.222.157.50	192.168.2.23
Jan 19, 2025 02:57:14.655714989 CET	57896	13566	192.168.2.23	83.222.157.50
Jan 19, 2025 02:57:14.660793066 CET	57896	13566	192.168.2.23	83.222.157.50
Jan 19, 2025 02:57:14.665757895 CET	13566	57896	83.222.157.50	192.168.2.23
Jan 19, 2025 02:57:14.665822983 CET	57896	13566	192.168.2.23	83.222.157.50
Jan 19, 2025 02:57:14.667509079 CET	42102	13566	192.168.2.23	83.222.19.4
Jan 19, 2025 02:57:14.672375917 CET	13566	42102	83.222.19.4	192.168.2.23
Jan 19, 2025 02:57:14.672461987 CET	42102	13566	192.168.2.23	83.222.19.4
Jan 19, 2025 02:57:14.674808025 CET	42102	13566	192.168.2.23	83.222.19.4
Jan 19, 2025 02:57:14.679717064 CET	13566	42102	83.222.19.4	192.168.2.23
Jan 19, 2025 02:57:14.679800034 CET	42102	13566	192.168.2.23	83.222.19.4
Jan 19, 2025 02:57:14.686134100 CET	47828	13566	192.168.2.23	83.222.77.114
Jan 19, 2025 02:57:14.691025972 CET	13566	47828	83.222.77.114	192.168.2.23
Jan 19, 2025 02:57:14.691107988 CET	47828	13566	192.168.2.23	83.222.77.114
Jan 19, 2025 02:57:14.692287922 CET	47828	13566	192.168.2.23	83.222.77.114
Jan 19, 2025 02:57:14.697190046 CET	13566	47828	83.222.77.114	192.168.2.23
Jan 19, 2025 02:57:14.697251081 CET	47828	13566	192.168.2.23	83.222.77.114
Jan 19, 2025 02:57:14.698558092 CET	41898	13566	192.168.2.23	83.222.249.226
Jan 19, 2025 02:57:14.703491926 CET	13566	41898	83.222.249.226	192.168.2.23
Jan 19, 2025 02:57:14.703888893 CET	41898	13566	192.168.2.23	83.222.249.226
Jan 19, 2025 02:57:14.711334944 CET	41898	13566	192.168.2.23	83.222.249.226
Jan 19, 2025 02:57:14.716376066 CET	13566	41898	83.222.249.226	192.168.2.23
Jan 19, 2025 02:57:14.716478109 CET	41898	13566	192.168.2.23	83.222.249.226
Jan 19, 2025 02:57:14.720316887 CET	56328	13566	192.168.2.23	83.222.21.47
Jan 19, 2025 02:57:14.725277901 CET	13566	56328	83.222.21.47	192.168.2.23
Jan 19, 2025 02:57:14.725353003 CET	56328	13566	192.168.2.23	83.222.21.47
Jan 19, 2025 02:57:14.733082056 CET	56328	13566	192.168.2.23	83.222.21.47
Jan 19, 2025 02:57:14.738049984 CET	13566	56328	83.222.21.47	192.168.2.23
Jan 19, 2025 02:57:14.738125086 CET	56328	13566	192.168.2.23	83.222.21.47
Jan 19, 2025 02:57:14.739027023 CET	56672	13566	192.168.2.23	83.222.164.140
Jan 19, 2025 02:57:14.743941069 CET	13566	56672	83.222.164.140	192.168.2.23
Jan 19, 2025 02:57:14.744016886 CET	56672	13566	192.168.2.23	83.222.164.140
Jan 19, 2025 02:57:14.748692036 CET	56672	13566	192.168.2.23	83.222.164.140
Jan 19, 2025 02:57:14.753560066 CET	13566	56672	83.222.164.140	192.168.2.23
Jan 19, 2025 02:57:14.753621101 CET	56672	13566	192.168.2.23	83.222.164.140
Jan 19, 2025 02:57:14.760567904 CET	52336	13566	192.168.2.23	83.222.141.124
Jan 19, 2025 02:57:14.766670942 CET	13566	52336	83.222.141.124	192.168.2.23
Jan 19, 2025 02:57:14.766957045 CET	52336	13566	192.168.2.23	83.222.141.124
Jan 19, 2025 02:57:14.771117926 CET	52336	13566	192.168.2.23	83.222.141.124
Jan 19, 2025 02:57:14.774187088 CET	59018	13566	192.168.2.23	83.222.133.209
Jan 19, 2025 02:57:14.777362108 CET	13566	52336	83.222.141.124	192.168.2.23
Jan 19, 2025 02:57:14.777420044 CET	52336	13566	192.168.2.23	83.222.141.124
Jan 19, 2025 02:57:14.780256987 CET	13566	59018	83.222.133.209	192.168.2.23
Jan 19, 2025 02:57:14.780313969 CET	59018	13566	192.168.2.23	83.222.133.209
Jan 19, 2025 02:57:14.781320095 CET	35638	13566	192.168.2.23	83.222.169.31
Jan 19, 2025 02:57:14.786166906 CET	13566	35638	83.222.169.31	192.168.2.23
Jan 19, 2025 02:57:14.786233902 CET	35638	13566	192.168.2.23	83.222.169.31
Jan 19, 2025 02:57:14.788328886 CET	52808	13566	192.168.2.23	83.222.85.62
Jan 19, 2025 02:57:14.793206930 CET	13566	52808	83.222.85.62	192.168.2.23
Jan 19, 2025 02:57:14.793266058 CET	52808	13566	192.168.2.23	83.222.85.62
Jan 19, 2025 02:57:14.797002077 CET	51148	13566	192.168.2.23	83.222.31.12
Jan 19, 2025 02:57:14.801951885 CET	13566	51148	83.222.31.12	192.168.2.23
Jan 19, 2025 02:57:14.802067995 CET	51148	13566	192.168.2.23	83.222.31.12
Jan 19, 2025 02:57:14.802911043 CET	39680	13566	192.168.2.23	83.222.70.210
Jan 19, 2025 02:57:14.807966948 CET	13566	39680	83.222.70.210	192.168.2.23
Jan 19, 2025 02:57:14.808026075 CET	39680	13566	192.168.2.23	83.222.70.210
Jan 19, 2025 02:57:14.811526060 CET	37208	13566	192.168.2.23	83.222.151.127
Jan 19, 2025 02:57:14.816479921 CET	13566	37208	83.222.151.127	192.168.2.23
Jan 19, 2025 02:57:14.816817999 CET	37208	13566	192.168.2.23	83.222.151.127
Jan 19, 2025 02:57:14.818276882 CET	55468	13566	192.168.2.23	83.222.10.0
Jan 19, 2025 02:57:14.823144913 CET	13566	55468	83.222.10.0	192.168.2.23
Jan 19, 2025 02:57:14.823249102 CET	55468	13566	192.168.2.23	83.222.10.0
Jan 19, 2025 02:57:14.831140041 CET	48026	13566	192.168.2.23	83.222.101.220
Jan 19, 2025 02:57:14.836797953 CET	13566	48026	83.222.101.220	192.168.2.23
Jan 19, 2025 02:57:14.836929083 CET	48026	13566	192.168.2.23	83.222.101.220
Jan 19, 2025 02:57:14.837626934 CET	48026	13566	192.168.2.23	83.222.101.220
Jan 19, 2025 02:57:14.840647936 CET	53836	13566	192.168.2.23	83.222.252.2
Jan 19, 2025 02:57:14.842519045 CET	13566	48026	83.222.101.220	192.168.2.23
Jan 19, 2025 02:57:14.842559099 CET	13566	48026	83.222.101.220	192.168.2.23
Jan 19, 2025 02:57:14.842916965 CET	48026	13566	192.168.2.23	83.222.101.220
Jan 19, 2025 02:57:14.845510960 CET	13566	53836	83.222.252.2	192.168.2.23
Jan 19, 2025 02:57:14.845568895 CET	53836	13566	192.168.2.23	83.222.252.2
Jan 19, 2025 02:57:14.848337889 CET	34610	13566	192.168.2.23	83.222.15.16
Jan 19, 2025 02:57:14.853306055 CET	13566	34610	83.222.15.16	192.168.2.23
Jan 19, 2025 02:57:14.853369951 CET	34610	13566	192.168.2.23	83.222.15.16
Jan 19, 2025 02:57:14.855283976 CET	45552	13566	192.168.2.23	83.222.6.92
Jan 19, 2025 02:57:14.860281944 CET	13566	45552	83.222.6.92	192.168.2.23
Jan 19, 2025 02:57:14.860538006 CET	45552	13566	192.168.2.23	83.222.6.92
Jan 19, 2025 02:57:14.861834049 CET	48656	13566	192.168.2.23	83.222.130.255
Jan 19, 2025 02:57:14.866703033 CET	13566	48656	83.222.130.255	192.168.2.23
Jan 19, 2025 02:57:14.866774082 CET	48656	13566	192.168.2.23	83.222.130.255
Jan 19, 2025 02:57:14.867448092 CET	40928	13566	192.168.2.23	83.222.62.151
Jan 19, 2025 02:57:14.870376110 CET	39644	13566	192.168.2.23	83.222.46.226
Jan 19, 2025 02:57:14.872309923 CET	13566	40928	83.222.62.151	192.168.2.23
Jan 19, 2025 02:57:14.872381926 CET	40928	13566	192.168.2.23	83.222.62.151
Jan 19, 2025 02:57:14.873742104 CET	56990	13566	192.168.2.23	83.222.36.187
Jan 19, 2025 02:57:14.875276089 CET	13566	39644	83.222.46.226	192.168.2.23
Jan 19, 2025 02:57:14.875334978 CET	39644	13566	192.168.2.23	83.222.46.226
Jan 19, 2025 02:57:14.877906084 CET	55972	13566	192.168.2.23	83.222.95.169
Jan 19, 2025 02:57:14.878673077 CET	13566	56990	83.222.36.187	192.168.2.23
Jan 19, 2025 02:57:14.878765106 CET	56990	13566	192.168.2.23	83.222.36.187
Jan 19, 2025 02:57:14.882787943 CET	13566	55972	83.222.95.169	192.168.2.23
Jan 19, 2025 02:57:14.882883072 CET	55972	13566	192.168.2.23	83.222.95.169
Jan 19, 2025 02:57:14.883483887 CET	54982	13566	192.168.2.23	83.222.141.8
Jan 19, 2025 02:57:14.888375044 CET	54506	13566	192.168.2.23	83.222.200.226
Jan 19, 2025 02:57:14.888401985 CET	13566	54982	83.222.141.8	192.168.2.23
Jan 19, 2025 02:57:14.888453007 CET	54982	13566	192.168.2.23	83.222.141.8
Jan 19, 2025 02:57:14.892610073 CET	52964	13566	192.168.2.23	83.222.70.231
Jan 19, 2025 02:57:14.893315077 CET	13566	54506	83.222.200.226	192.168.2.23
Jan 19, 2025 02:57:14.893418074 CET	54506	13566	192.168.2.23	83.222.200.226
Jan 19, 2025 02:57:14.896219969 CET	45506	13566	192.168.2.23	83.222.238.140
Jan 19, 2025 02:57:14.897528887 CET	13566	52964	83.222.70.231	192.168.2.23
Jan 19, 2025 02:57:14.897629023 CET	52964	13566	192.168.2.23	83.222.70.231
Jan 19, 2025 02:57:14.899810076 CET	46892	13566	192.168.2.23	83.222.185.134
Jan 19, 2025 02:57:14.901104927 CET	13566	45506	83.222.238.140	192.168.2.23
Jan 19, 2025 02:57:14.901161909 CET	45506	13566	192.168.2.23	83.222.238.140
Jan 19, 2025 02:57:14.904616117 CET	13566	46892	83.222.185.134	192.168.2.23
Jan 19, 2025 02:57:14.904664040 CET	46892	13566	192.168.2.23	83.222.185.134
Jan 19, 2025 02:57:14.904869080 CET	45912	13566	192.168.2.23	83.222.12.195
Jan 19, 2025 02:57:14.907931089 CET	43064	13566	192.168.2.23	83.222.134.113
Jan 19, 2025 02:57:14.909713984 CET	13566	45912	83.222.12.195	192.168.2.23
Jan 19, 2025 02:57:14.909771919 CET	45912	13566	192.168.2.23	83.222.12.195
Jan 19, 2025 02:57:14.910878897 CET	33594	13566	192.168.2.23	83.222.159.131
Jan 19, 2025 02:57:14.912861109 CET	13566	43064	83.222.134.113	192.168.2.23
Jan 19, 2025 02:57:14.912919998 CET	43064	13566	192.168.2.23	83.222.134.113
Jan 19, 2025 02:57:14.913465023 CET	54026	13566	192.168.2.23	83.222.115.174
Jan 19, 2025 02:57:14.916029930 CET	13566	33594	83.222.159.131	192.168.2.23
Jan 19, 2025 02:57:14.916083097 CET	33594	13566	192.168.2.23	83.222.159.131
Jan 19, 2025 02:57:14.918023109 CET	56678	13566	192.168.2.23	83.222.147.121
Jan 19, 2025 02:57:14.918896914 CET	13566	54026	83.222.115.174	192.168.2.23
Jan 19, 2025 02:57:14.919039965 CET	54026	13566	192.168.2.23	83.222.115.174
Jan 19, 2025 02:57:14.923069954 CET	13566	56678	83.222.147.121	192.168.2.23
Jan 19, 2025 02:57:14.923125982 CET	56678	13566	192.168.2.23	83.222.147.121
Jan 19, 2025 02:57:14.923652887 CET	33792	13566	192.168.2.23	83.222.10.21
Jan 19, 2025 02:57:14.928750992 CET	60184	13566	192.168.2.23	83.222.121.73
Jan 19, 2025 02:57:14.929104090 CET	13566	33792	83.222.10.21	192.168.2.23
Jan 19, 2025 02:57:14.929160118 CET	33792	13566	192.168.2.23	83.222.10.21
Jan 19, 2025 02:57:14.935400009 CET	13566	60184	83.222.121.73	192.168.2.23
Jan 19, 2025 02:57:14.935456991 CET	60184	13566	192.168.2.23	83.222.121.73
Jan 19, 2025 02:57:14.935955048 CET	43862	13566	192.168.2.23	83.222.172.167
Jan 19, 2025 02:57:14.941395998 CET	57224	13566	192.168.2.23	83.222.43.208
Jan 19, 2025 02:57:14.942190886 CET	13566	43862	83.222.172.167	192.168.2.23
Jan 19, 2025 02:57:14.942318916 CET	43862	13566	192.168.2.23	83.222.172.167
Jan 19, 2025 02:57:14.945127010 CET	50514	13566	192.168.2.23	83.222.99.138
Jan 19, 2025 02:57:14.947639942 CET	13566	57224	83.222.43.208	192.168.2.23
Jan 19, 2025 02:57:14.947748899 CET	57224	13566	192.168.2.23	83.222.43.208
Jan 19, 2025 02:57:14.950968981 CET	34914	13566	192.168.2.23	83.222.121.240
Jan 19, 2025 02:57:14.951292992 CET	13566	50514	83.222.99.138	192.168.2.23
Jan 19, 2025 02:57:14.951347113 CET	50514	13566	192.168.2.23	83.222.99.138
Jan 19, 2025 02:57:14.955815077 CET	13566	34914	83.222.121.240	192.168.2.23
Jan 19, 2025 02:57:14.955885887 CET	34914	13566	192.168.2.23	83.222.121.240
Jan 19, 2025 02:57:14.956382990 CET	49234	13566	192.168.2.23	83.222.147.65
Jan 19, 2025 02:57:14.962410927 CET	13566	49234	83.222.147.65	192.168.2.23
Jan 19, 2025 02:57:14.962615013 CET	49234	13566	192.168.2.23	83.222.147.65
Jan 19, 2025 02:57:14.965177059 CET	40832	13566	192.168.2.23	83.222.210.217
Jan 19, 2025 02:57:14.970052004 CET	13566	40832	83.222.210.217	192.168.2.23
Jan 19, 2025 02:57:14.970124960 CET	40832	13566	192.168.2.23	83.222.210.217
Jan 19, 2025 02:57:14.973350048 CET	44736	13566	192.168.2.23	83.222.40.193
Jan 19, 2025 02:57:14.978207111 CET	13566	44736	83.222.40.193	192.168.2.23
Jan 19, 2025 02:57:14.978276968 CET	44736	13566	192.168.2.23	83.222.40.193
Jan 19, 2025 02:57:14.982280016 CET	44736	13566	192.168.2.23	83.222.40.193
Jan 19, 2025 02:57:14.987196922 CET	13566	44736	83.222.40.193	192.168.2.23
Jan 19, 2025 02:57:14.987263918 CET	44736	13566	192.168.2.23	83.222.40.193
Jan 19, 2025 02:57:14.987858057 CET	36200	13566	192.168.2.23	83.222.102.225
Jan 19, 2025 02:57:14.992816925 CET	13566	36200	83.222.102.225	192.168.2.23
Jan 19, 2025 02:57:14.993037939 CET	36200	13566	192.168.2.23	83.222.102.225
Jan 19, 2025 02:57:15.018603086 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:15.023637056 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:57:15.023843050 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:15.031038046 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:15.036075115 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:57:15.036144972 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:15.041101933 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:57:18.669315100 CET	42836	443	192.168.2.23	91.189.91.43
Jan 19, 2025 02:57:25.036583900 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:25.041764975 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:57:25.238267899 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:57:25.238404989 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:25.690293074 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:57:25.690365076 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:57:35.051002979 CET	43928	443	192.168.2.23	91.189.91.42
Jan 19, 2025 02:57:43.241867065 CET	42516	80	192.168.2.23	109.202.202.202
Jan 19, 2025 02:57:45.289578915 CET	42836	443	192.168.2.23	91.189.91.43
Jan 19, 2025 02:58:16.005441904 CET	43928	443	192.168.2.23	91.189.91.42
Jan 19, 2025 02:58:25.732475996 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:58:25.737431049 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:58:25.940582991 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:58:25.940979958 CET	42774	13566	192.168.2.23	83.222.191.90
Jan 19, 2025 02:58:26.686264992 CET	13566	42774	83.222.191.90	192.168.2.23
Jan 19, 2025 02:58:26.686608076 CET	42774	13566	192.168.2.23	83.222.191.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2025 02:57:15.003725052 CET	37950	53	192.168.2.23	8.8.8.8
Jan 19, 2025 02:57:15.013700962 CET	53	37950	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 19, 2025 02:57:15.003725052 CET	192.168.2.23	8.8.8.8	0xd461	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 19, 2025 02:57:15.013700962 CET	8.8.8.8	192.168.2.23	0xd461	No error (0)	secure-network-rebirthltd.ru		83.222.191.90	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Kloki.arm5.elf PID: 6267, Parent PID: 6191

General

Start time (UTC):	01:57:13
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.arm5.elf
Arguments:	/tmp/Kloki.arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: Kloki.arm5.elf PID: 6269, Parent PID: 6267

General

Start time (UTC):	01:57:13
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: Kloki.arm5.elf PID: 6271, Parent PID: 6267

General

Start time (UTC):	01:57:13
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: Kloki.arm5.elf PID: 6273, Parent PID: 6271

General

Start time (UTC):	01:57:13
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

Directory Enumerated

Process Activities

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: gnome-session-binary PID: 6294, Parent PID: 1477

General

Start time (UTC):	01:57:13
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6294, Parent PID: 1477

General

Start time (UTC):	01:57:13
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gnome-session-binary PID: 6296, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6296, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gnome-session-binary PID: 6298, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6298, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Chronological Activities

Analysis Process: gnome-session-binary PID: 6301, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6301, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gnome-shell PID: 6301, Parent PID: 1477

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

File Activities

File Opened

Chronological Activities

Analysis Process: gdm3 PID: 6302, Parent PID: 1320

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 6302, Parent PID: 1320

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gdm3 PID: 6304, Parent PID: 1320

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 6304, Parent PID: 1320

General

Start time (UTC):	01:57:14
Start date (UTC):	19/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Source: Kloki.arm5.elf	Virustotal: Detection: 38%			Perma Link
Source: Kloki.arm5.elf	ReversingLabs: Detection: 42%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Kloki.arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Kloki.arm5.elf PID: 6267, Parent PID: 6191

General

File Activities

File Opened

File Read

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: Kloki.arm5.elf PID: 6269, Parent PID: 6267

General

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Linux Analysis Report
Kloki.arm5.elf