Edit tour

Linux Analysis Report
Kloki.i686.elf

Overview

General Information

Sample name:	Kloki.i686.elf
Analysis ID:	1594501
MD5:	402f0360f10fb6a1e4fa5db07ea2097e
SHA1:	d1dbfd0063a13d099f5279559aec456a83112fbf
SHA256:	ef2c3a5af2266e147fa68bb6b20f5ed2f4c7bec1b131b3294bc7cb7a9b3b17f3
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1594501
Start date and time:	2025-01-19 03:37:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Kloki.i686.elf
Detection:	MAL
Classification:	mal64.spre.linELF@0/0@1/0

Runtime Messages

Command:	/tmp/Kloki.i686.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	suka
Standard Error:

Process Tree

system is lnxubuntu20

Kloki.i686.elf (PID: 5433, Parent: 5355, MD5: 402f0360f10fb6a1e4fa5db07ea2097e) Arguments: /tmp/Kloki.i686.elf

Kloki.i686.elf New Fork (PID: 5434, Parent: 5433)

Kloki.i686.elf New Fork (PID: 5435, Parent: 5433)

Kloki.i686.elf New Fork (PID: 5436, Parent: 5435)

gnome-session-binary New Fork (PID: 5437, Parent: 1588)

sh (PID: 5437, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5437, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 5459, Parent: 1588)

sh (PID: 5459, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5459, Parent: 1588, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-session-binary New Fork (PID: 5461, Parent: 1588)

sh (PID: 5461, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 5461, Parent: 1588, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 5462, Parent: 1588)

sh (PID: 5462, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gdm3 New Fork (PID: 5463, Parent: 1400)

Default (PID: 5463, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5464, Parent: 1400)

Default (PID: 5464, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5475, Parent: 1)

systemd-user-runtime-dir (PID: 5475, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Kloki.i686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x54ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
Kloki.i686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x54b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
Kloki.i686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x682:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x6e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
Kloki.i686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7b52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
Kloki.i686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x949f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08

Memory Dumps

Source	Rule	Description	Author	Strings
5433.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x54ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5433.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x54b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5433.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x682:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x6e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5433.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7b52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5433.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x949f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5434.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x54ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5434.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x54b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5434.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x682:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x6e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5434.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7b52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5434.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x949f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 5 entries

Suricata Signatures

ET COMPROMISED Known Compromised or Hostile Host Traffic group 18

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-19T03:37:55.366217+0100	2500034	2	Misc Attack	83.222.191.90	13566	192.168.2.13	42868	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Kloki.i686.elf

Virustotal: Detection: 14%

Perma Link

Machine Learning detection for sample

Source: Kloki.i686.elf

Joe Sandbox ML: detected

Source: Kloki.i686.elf

String: Xfppid/proc/net/tcp/proc/self/exe/proc//status/fd//dev/null/dev/consolesocket05/proc/%d/exepkillkillallechowgetcurlpsbusyboxiptablesrebootshutdownhaltpoweroffsystemctltelinitcatgrepbashzshcshkshdashfish

Source: global traffic	TCP traffic: 192.168.2.13:34304 -> 83.222.103.245:13566
Source: global traffic	TCP traffic: 192.168.2.13:37008 -> 83.222.87.142:13566
Source: global traffic	TCP traffic: 192.168.2.13:38980 -> 83.222.96.67:13566
Source: global traffic	TCP traffic: 192.168.2.13:34758 -> 83.222.152.17:13566
Source: global traffic	TCP traffic: 192.168.2.13:49554 -> 83.222.78.237:13566
Source: global traffic	TCP traffic: 192.168.2.13:44210 -> 83.222.204.106:13566
Source: global traffic	TCP traffic: 192.168.2.13:47668 -> 83.222.230.25:13566
Source: global traffic	TCP traffic: 192.168.2.13:54174 -> 83.222.140.194:13566
Source: global traffic	TCP traffic: 192.168.2.13:48274 -> 83.222.118.91:13566
Source: global traffic	TCP traffic: 192.168.2.13:49002 -> 83.222.119.76:13566
Source: global traffic	TCP traffic: 192.168.2.13:51110 -> 83.222.183.136:13566
Source: global traffic	TCP traffic: 192.168.2.13:51950 -> 83.222.212.238:13566
Source: global traffic	TCP traffic: 192.168.2.13:41192 -> 83.222.40.112:13566
Source: global traffic	TCP traffic: 192.168.2.13:43642 -> 83.222.44.150:13566
Source: global traffic	TCP traffic: 192.168.2.13:37576 -> 83.222.22.21:13566
Source: global traffic	TCP traffic: 192.168.2.13:44324 -> 83.222.55.148:13566
Source: global traffic	TCP traffic: 192.168.2.13:35244 -> 83.222.139.151:13566
Source: global traffic	TCP traffic: 192.168.2.13:44262 -> 83.222.215.227:13566
Source: global traffic	TCP traffic: 192.168.2.13:55260 -> 83.222.244.115:13566
Source: global traffic	TCP traffic: 192.168.2.13:53804 -> 83.222.93.129:13566
Source: global traffic	TCP traffic: 192.168.2.13:56550 -> 83.222.53.211:13566
Source: global traffic	TCP traffic: 192.168.2.13:39152 -> 83.222.37.112:13566
Source: global traffic	TCP traffic: 192.168.2.13:33000 -> 83.222.220.2:13566
Source: global traffic	TCP traffic: 192.168.2.13:45744 -> 83.222.61.4:13566
Source: global traffic	TCP traffic: 192.168.2.13:42452 -> 83.222.114.84:13566
Source: global traffic	TCP traffic: 192.168.2.13:34956 -> 83.222.26.88:13566
Source: global traffic	TCP traffic: 192.168.2.13:41226 -> 83.222.164.36:13566
Source: global traffic	TCP traffic: 192.168.2.13:47894 -> 83.222.109.145:13566
Source: global traffic	TCP traffic: 192.168.2.13:57386 -> 83.222.25.120:13566
Source: global traffic	TCP traffic: 192.168.2.13:38164 -> 83.222.19.70:13566
Source: global traffic	TCP traffic: 192.168.2.13:47528 -> 83.222.218.154:13566
Source: global traffic	TCP traffic: 192.168.2.13:51596 -> 83.222.225.177:13566
Source: global traffic	TCP traffic: 192.168.2.13:43758 -> 83.222.14.74:13566
Source: global traffic	TCP traffic: 192.168.2.13:43320 -> 83.222.125.7:13566
Source: global traffic	TCP traffic: 192.168.2.13:53792 -> 83.222.33.113:13566
Source: global traffic	TCP traffic: 192.168.2.13:43346 -> 83.222.122.126:13566
Source: global traffic	TCP traffic: 192.168.2.13:39494 -> 83.222.242.176:13566
Source: global traffic	TCP traffic: 192.168.2.13:44232 -> 83.222.81.206:13566
Source: global traffic	TCP traffic: 192.168.2.13:34198 -> 83.222.178.143:13566
Source: global traffic	TCP traffic: 192.168.2.13:51224 -> 83.222.211.36:13566
Source: global traffic	TCP traffic: 192.168.2.13:49976 -> 83.222.227.237:13566
Source: global traffic	TCP traffic: 192.168.2.13:35464 -> 83.222.124.80:13566
Source: global traffic	TCP traffic: 192.168.2.13:47122 -> 83.222.126.32:13566
Source: global traffic	TCP traffic: 192.168.2.13:55540 -> 83.222.153.136:13566
Source: global traffic	TCP traffic: 192.168.2.13:53186 -> 83.222.221.167:13566
Source: global traffic	TCP traffic: 192.168.2.13:47060 -> 83.222.210.183:13566
Source: global traffic	TCP traffic: 192.168.2.13:42508 -> 83.222.117.151:13566
Source: global traffic	TCP traffic: 192.168.2.13:37468 -> 83.222.65.179:13566
Source: global traffic	TCP traffic: 192.168.2.13:54558 -> 83.222.105.190:13566
Source: global traffic	TCP traffic: 192.168.2.13:45090 -> 83.222.186.138:13566
Source: global traffic	TCP traffic: 192.168.2.13:39204 -> 83.222.48.53:13566
Source: global traffic	TCP traffic: 192.168.2.13:46648 -> 83.222.9.34:13566
Source: global traffic	TCP traffic: 192.168.2.13:56230 -> 83.222.229.90:13566
Source: global traffic	TCP traffic: 192.168.2.13:48454 -> 83.222.241.151:13566
Source: global traffic	TCP traffic: 192.168.2.13:38462 -> 83.222.233.196:13566
Source: global traffic	TCP traffic: 192.168.2.13:37288 -> 83.222.177.55:13566
Source: global traffic	TCP traffic: 192.168.2.13:38178 -> 83.222.187.204:13566
Source: global traffic	TCP traffic: 192.168.2.13:48802 -> 83.222.29.47:13566
Source: global traffic	TCP traffic: 192.168.2.13:52412 -> 83.222.87.146:13566
Source: global traffic	TCP traffic: 192.168.2.13:39262 -> 83.222.198.240:13566
Source: global traffic	TCP traffic: 192.168.2.13:38226 -> 83.222.26.164:13566
Source: global traffic	TCP traffic: 192.168.2.13:43350 -> 83.222.152.236:13566
Source: global traffic	TCP traffic: 192.168.2.13:57900 -> 83.222.91.217:13566
Source: global traffic	TCP traffic: 192.168.2.13:42796 -> 83.222.159.196:13566
Source: global traffic	TCP traffic: 192.168.2.13:35972 -> 83.222.152.90:13566
Source: global traffic	TCP traffic: 192.168.2.13:49638 -> 83.222.79.200:13566
Source: global traffic	TCP traffic: 192.168.2.13:45434 -> 83.222.143.88:13566
Source: global traffic	TCP traffic: 192.168.2.13:59150 -> 83.222.234.116:13566
Source: global traffic	TCP traffic: 192.168.2.13:51342 -> 83.222.178.219:13566
Source: global traffic	TCP traffic: 192.168.2.13:55704 -> 83.222.11.156:13566
Source: global traffic	TCP traffic: 192.168.2.13:42746 -> 83.222.159.198:13566
Source: global traffic	TCP traffic: 192.168.2.13:48792 -> 83.222.253.133:13566
Source: global traffic	TCP traffic: 192.168.2.13:34972 -> 83.222.127.84:13566
Source: global traffic	TCP traffic: 192.168.2.13:34504 -> 83.222.104.80:13566
Source: global traffic	TCP traffic: 192.168.2.13:54478 -> 83.222.69.49:13566
Source: global traffic	TCP traffic: 192.168.2.13:43264 -> 83.222.23.70:13566
Source: global traffic	TCP traffic: 192.168.2.13:36542 -> 83.222.234.221:13566
Source: global traffic	TCP traffic: 192.168.2.13:40490 -> 83.222.29.69:13566
Source: global traffic	TCP traffic: 192.168.2.13:41544 -> 83.222.182.189:13566
Source: global traffic	TCP traffic: 192.168.2.13:53104 -> 83.222.10.78:13566
Source: global traffic	TCP traffic: 192.168.2.13:57162 -> 83.222.23.89:13566
Source: global traffic	TCP traffic: 192.168.2.13:58146 -> 83.222.22.166:13566
Source: global traffic	TCP traffic: 192.168.2.13:35922 -> 83.222.177.1:13566
Source: global traffic	TCP traffic: 192.168.2.13:57406 -> 83.222.26.99:13566
Source: global traffic	TCP traffic: 192.168.2.13:35816 -> 83.222.220.37:13566
Source: global traffic	TCP traffic: 192.168.2.13:57168 -> 83.222.255.124:13566
Source: global traffic	TCP traffic: 192.168.2.13:35282 -> 83.222.235.104:13566
Source: global traffic	TCP traffic: 192.168.2.13:40458 -> 83.222.204.232:13566
Source: global traffic	TCP traffic: 192.168.2.13:45218 -> 83.222.237.76:13566
Source: global traffic	TCP traffic: 192.168.2.13:56808 -> 83.222.60.5:13566
Source: global traffic	TCP traffic: 192.168.2.13:43640 -> 83.222.146.129:13566
Source: global traffic	TCP traffic: 192.168.2.13:57686 -> 83.222.54.124:13566
Source: global traffic	TCP traffic: 192.168.2.13:50412 -> 83.222.94.84:13566
Source: global traffic	TCP traffic: 192.168.2.13:46422 -> 83.222.193.21:13566
Source: global traffic	TCP traffic: 192.168.2.13:48448 -> 83.222.17.203:13566
Source: global traffic	TCP traffic: 192.168.2.13:44082 -> 83.222.99.40:13566
Source: global traffic	TCP traffic: 192.168.2.13:52320 -> 83.222.36.122:13566
Source: global traffic	TCP traffic: 192.168.2.13:48406 -> 83.222.206.213:13566
Source: global traffic	TCP traffic: 192.168.2.13:54550 -> 83.222.123.232:13566
Source: global traffic	TCP traffic: 192.168.2.13:53358 -> 83.222.57.87:13566
Source: global traffic	TCP traffic: 192.168.2.13:55842 -> 83.222.13.56:13566
Source: global traffic	TCP traffic: 192.168.2.13:40988 -> 83.222.211.248:13566
Source: global traffic	TCP traffic: 192.168.2.13:50918 -> 83.222.160.160:13566
Source: global traffic	TCP traffic: 192.168.2.13:42868 -> 83.222.191.90:13566

Source: Network traffic

Suricata IDS: 2500034 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 18 : 83.222.191.90:13566 -> 192.168.2.13:42868

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.103.245
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.87.142
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.96.67
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.152.17
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.78.237
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.204.106
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.230.25
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.140.194
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.118.91
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.119.76
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.183.136
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.212.238
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.40.112
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.44.150
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.22.21
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.55.148
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.139.151
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.215.227
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.244.115
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.93.129
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.53.211
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.37.112
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.220.2
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.61.4
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.114.84
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.26.88
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.164.36
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.109.145
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.25.120
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.19.70
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.218.154
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.225.177
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.14.74
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.125.7
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.33.113
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.122.126
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.242.176
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.81.206
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.178.143
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.211.36
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.227.237
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.124.80
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.126.32
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.153.136
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.221.167
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.117.151
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.65.179
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.105.190
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.186.138
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.48.53

Source: global traffic

DNS traffic detected: DNS query: secure-network-rebirthltd.ru

System Summary

Malicious sample detected (through community Yara rule)

Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1691, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1866, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5437, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: Xfppid/proc/net/tcp/proc/self/exe/proc//status/fd//dev/null/dev/consolesocket05/proc/%d/exepkillkillallechowgetcurlpsbusyboxiptablesrebootshutdownhaltpoweroffsystemctltelinitcatgrepbashzshcshkshdashfish

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1691, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1866, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5437, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/Kloki.i686.elf (PID: 5436)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior

Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: Kloki.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26

Source: classification engine

Classification label: mal64.spre.linELF@0/0@1/0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Kloki.i686.elf	14%	Virustotal		Browse
Kloki.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
secure-network-rebirthltd.ru	83.222.191.90	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
83.222.198.240	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.152.17	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.241.151	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.183.136	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.61.4	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.19.70	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.22.166	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.91.217	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.152.90	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.122.126	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.29.47	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.211.248	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.229.90	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.177.1	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.81.206	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.211.36	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.234.116	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.54.124	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.94.84	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.160.160	unknown	Bulgaria	49040	KIG-UNISAT-TVBG	false
83.222.65.179	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.220.37	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.23.70	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.178.219	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.22.21	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.36.122	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.225.177	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.40.112	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.242.176	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.124.80	unknown	Russian Federation	47328	TRI-ASTrueRecordsIncES	false
83.222.143.88	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.123.232	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.210.183	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.187.204	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.53.211	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.204.232	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.193.21	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.206.213	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.204.106	unknown	Russian Federation	6854	SYNTERRA-ASRU	false
83.222.118.91	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.191.90	secure-network-rebirthltd.ru	Bulgaria	43561	NET1-ASBG	false
83.222.237.76	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.14.74	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.104.80	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.99.40	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.140.194	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.234.221	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.186.138	unknown	Bulgaria	43561	NET1-ASBG	false
83.222.48.53	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.233.196	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.215.227	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.11.156	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.13.56	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.44.150	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.37.112	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.178.143	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.9.34	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.109.145	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.26.99	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.96.67	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.218.154	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.126.32	unknown	Russian Federation	47328	TRI-ASTrueRecordsIncES	false
83.222.87.142	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.127.84	unknown	Russian Federation	47328	TRI-ASTrueRecordsIncES	false
83.222.164.36	unknown	Bulgaria	31037	WAVENETLB	false
83.222.87.146	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.221.167	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.139.151	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.119.76	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.230.25	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.79.200	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.220.2	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.212.238	unknown	Russian Federation	25159	SONICDUO-ASRU	false
83.222.153.136	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.26.164	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.60.5	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.235.104	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.55.148	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.17.203	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.159.198	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.29.69	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.25.120	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.182.189	unknown	Bulgaria	205872	EXTRANET-ASBG	false
83.222.10.78	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.23.89	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
83.222.159.196	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.177.55	unknown	Bulgaria	12615	GCN-ASGCNAD-SofiaBulgariaBG	false
83.222.69.49	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.255.124	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.78.237	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.253.133	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.117.151	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.244.115	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.57.87	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.93.129	unknown	Russian Federation	16285	ASN-UMNTechnicheskayaStr18bYekaterinburgRussiaRU	false
83.222.146.129	unknown	Switzerland	31736	SENSELAN-ASsenseLANGmbHCH	false
83.222.33.113	unknown	Luxembourg	8632	LOL-ASluLU	false
83.222.103.245	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
83.222.227.237	unknown	United Kingdom	13768	COGECO-PEER1CA	false
83.222.114.84	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
83.222.94.84	loki.x86.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
secure-network-rebirthltd.ru	Kloki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.ppc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.191.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGECO-PEER1CA	Kloki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.232.116
	loki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.237.134
	Kloki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.224.99
	loki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.247.103
	Kloki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.224.152
	Kloki.ppc.elf	Get hash	malicious	Unknown	Browse	83.222.243.167
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.228.152
	loki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.254.156
	loki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.233.216
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.240.133
SYNTERRA-ASRU	Kloki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.210.211
	loki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.195.162
	Kloki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.195.159
	loki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.196.148
	Kloki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.194.13
	Kloki.ppc.elf	Get hash	malicious	Unknown	Browse	83.222.195.110
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.206.80
	loki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.211.104
	loki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.195.237
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.211.69
GCN-ASGCNAD-SofiaBulgariaBG	Kloki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.174.216
	loki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.175.167
	Kloki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.176.33
	loki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.177.157
	Kloki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.173.11
	Kloki.ppc.elf	Get hash	malicious	Unknown	Browse	83.222.166.158
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.169.136
	loki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.166.153
	loki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.169.206
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.173.171
SENSELAN-ASsenseLANGmbHCH	Kloki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.128.248
	loki.mips.elf	Get hash	malicious	Unknown	Browse	83.222.140.196
	Kloki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.135.55
	loki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.153.195
	Kloki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.136.251
	Kloki.ppc.elf	Get hash	malicious	Unknown	Browse	83.222.152.112
	loki.mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.154.185
	loki.i486.elf	Get hash	malicious	Unknown	Browse	83.222.144.139
	loki.sh4.elf	Get hash	malicious	Unknown	Browse	83.222.159.6
	loki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.155.1

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.313748385488092
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Kloki.i686.elf
File size:	58'512 bytes
MD5:	402f0360f10fb6a1e4fa5db07ea2097e
SHA1:	d1dbfd0063a13d099f5279559aec456a83112fbf
SHA256:	ef2c3a5af2266e147fa68bb6b20f5ed2f4c7bec1b131b3294bc7cb7a9b3b17f3
SHA512:	3552d8a02cae85f6909a8279b17d711bf867c046571ae0621262a3eb96a04a3a288d07a685d7bcf5b7a69f906ed570671341ceb21d14a2be52c6d8db72d4088e
SSDEEP:	1536:cd8O3IFk1dTDSVTUwq/+5W1IdM1+iss6rBQPav5:cd8OYF4NDSVTUw+/Sq1+issuB2m5
TLSH:	BE431A81F98B80F6E80709315067F73FCB31D9394161DAAEDF99EF36EA23641921224D
File Content Preview:	.ELF....................h...4...........4. ...(.....................<...<....................`...`.......7..........Q.td............................U..S.......w....h........[]...$.............U......=.b...t..1....$`.....$`......u........t...$<_..........b

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	58112
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xc8c1	0x0	0x6	AX	16
.fini	PROGBITS	0x8054971	0xc971	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80549a0	0xc9a0	0x159c	0x0	0x2	A	32
.ctors	PROGBITS	0x8056000	0xe000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8056008	0xe008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8056020	0xe020	0x2a0	0x0	0x3	WA	32
.bss	NOBITS	0x80562c0	0xe2c0	0x3500	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xe2c0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xdf3c	0xdf3c	6.3602	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xe000	0x8056000	0x8056000	0x2c0	0x37c0	3.4387	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-19T03:37:55.366217+0100	2500034	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18	2	83.222.191.90	13566	192.168.2.13	42868	TCP

Network Port Distribution

Total Packets: 217
• 13566 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2025 03:37:55.346146107 CET	34304	13566	192.168.2.13	83.222.103.245
Jan 19, 2025 03:37:55.346168995 CET	37008	13566	192.168.2.13	83.222.87.142
Jan 19, 2025 03:37:55.346199989 CET	38980	13566	192.168.2.13	83.222.96.67
Jan 19, 2025 03:37:55.346199989 CET	34758	13566	192.168.2.13	83.222.152.17
Jan 19, 2025 03:37:55.346216917 CET	49554	13566	192.168.2.13	83.222.78.237
Jan 19, 2025 03:37:55.346244097 CET	44210	13566	192.168.2.13	83.222.204.106
Jan 19, 2025 03:37:55.346290112 CET	47668	13566	192.168.2.13	83.222.230.25
Jan 19, 2025 03:37:55.346311092 CET	54174	13566	192.168.2.13	83.222.140.194
Jan 19, 2025 03:37:55.346312046 CET	48274	13566	192.168.2.13	83.222.118.91
Jan 19, 2025 03:37:55.346313000 CET	49002	13566	192.168.2.13	83.222.119.76
Jan 19, 2025 03:37:55.346328974 CET	51110	13566	192.168.2.13	83.222.183.136
Jan 19, 2025 03:37:55.346354961 CET	51950	13566	192.168.2.13	83.222.212.238
Jan 19, 2025 03:37:55.346370935 CET	41192	13566	192.168.2.13	83.222.40.112
Jan 19, 2025 03:37:55.346375942 CET	43642	13566	192.168.2.13	83.222.44.150
Jan 19, 2025 03:37:55.346370935 CET	37576	13566	192.168.2.13	83.222.22.21
Jan 19, 2025 03:37:55.346393108 CET	44324	13566	192.168.2.13	83.222.55.148
Jan 19, 2025 03:37:55.346415997 CET	35244	13566	192.168.2.13	83.222.139.151
Jan 19, 2025 03:37:55.346427917 CET	44262	13566	192.168.2.13	83.222.215.227
Jan 19, 2025 03:37:55.346443892 CET	55260	13566	192.168.2.13	83.222.244.115
Jan 19, 2025 03:37:55.346456051 CET	53804	13566	192.168.2.13	83.222.93.129
Jan 19, 2025 03:37:55.346461058 CET	56550	13566	192.168.2.13	83.222.53.211
Jan 19, 2025 03:37:55.346465111 CET	39152	13566	192.168.2.13	83.222.37.112
Jan 19, 2025 03:37:55.346474886 CET	33000	13566	192.168.2.13	83.222.220.2
Jan 19, 2025 03:37:55.346510887 CET	45744	13566	192.168.2.13	83.222.61.4
Jan 19, 2025 03:37:55.346529007 CET	42452	13566	192.168.2.13	83.222.114.84
Jan 19, 2025 03:37:55.346529961 CET	34956	13566	192.168.2.13	83.222.26.88
Jan 19, 2025 03:37:55.346558094 CET	41226	13566	192.168.2.13	83.222.164.36
Jan 19, 2025 03:37:55.346564054 CET	47894	13566	192.168.2.13	83.222.109.145
Jan 19, 2025 03:37:55.346596956 CET	57386	13566	192.168.2.13	83.222.25.120
Jan 19, 2025 03:37:55.346611977 CET	38164	13566	192.168.2.13	83.222.19.70
Jan 19, 2025 03:37:55.346640110 CET	47528	13566	192.168.2.13	83.222.218.154
Jan 19, 2025 03:37:55.346642017 CET	51596	13566	192.168.2.13	83.222.225.177
Jan 19, 2025 03:37:55.346647978 CET	43758	13566	192.168.2.13	83.222.14.74
Jan 19, 2025 03:37:55.346674919 CET	43320	13566	192.168.2.13	83.222.125.7
Jan 19, 2025 03:37:55.346677065 CET	53792	13566	192.168.2.13	83.222.33.113
Jan 19, 2025 03:37:55.346690893 CET	43346	13566	192.168.2.13	83.222.122.126
Jan 19, 2025 03:37:55.346705914 CET	39494	13566	192.168.2.13	83.222.242.176
Jan 19, 2025 03:37:55.346736908 CET	44232	13566	192.168.2.13	83.222.81.206
Jan 19, 2025 03:37:55.346745968 CET	34198	13566	192.168.2.13	83.222.178.143
Jan 19, 2025 03:37:55.346772909 CET	51224	13566	192.168.2.13	83.222.211.36
Jan 19, 2025 03:37:55.346775055 CET	49976	13566	192.168.2.13	83.222.227.237
Jan 19, 2025 03:37:55.346828938 CET	35464	13566	192.168.2.13	83.222.124.80
Jan 19, 2025 03:37:55.346828938 CET	47122	13566	192.168.2.13	83.222.126.32
Jan 19, 2025 03:37:55.346865892 CET	55540	13566	192.168.2.13	83.222.153.136
Jan 19, 2025 03:37:55.346867085 CET	53186	13566	192.168.2.13	83.222.221.167
Jan 19, 2025 03:37:55.346879959 CET	47060	13566	192.168.2.13	83.222.210.183
Jan 19, 2025 03:37:55.346880913 CET	42508	13566	192.168.2.13	83.222.117.151
Jan 19, 2025 03:37:55.346894979 CET	37468	13566	192.168.2.13	83.222.65.179
Jan 19, 2025 03:37:55.346918106 CET	54558	13566	192.168.2.13	83.222.105.190
Jan 19, 2025 03:37:55.346926928 CET	45090	13566	192.168.2.13	83.222.186.138
Jan 19, 2025 03:37:55.346932888 CET	39204	13566	192.168.2.13	83.222.48.53
Jan 19, 2025 03:37:55.346961021 CET	46648	13566	192.168.2.13	83.222.9.34
Jan 19, 2025 03:37:55.346970081 CET	56230	13566	192.168.2.13	83.222.229.90
Jan 19, 2025 03:37:55.347002983 CET	48454	13566	192.168.2.13	83.222.241.151
Jan 19, 2025 03:37:55.347006083 CET	38462	13566	192.168.2.13	83.222.233.196
Jan 19, 2025 03:37:55.347038984 CET	37288	13566	192.168.2.13	83.222.177.55
Jan 19, 2025 03:37:55.347039938 CET	38178	13566	192.168.2.13	83.222.187.204
Jan 19, 2025 03:37:55.347057104 CET	48802	13566	192.168.2.13	83.222.29.47
Jan 19, 2025 03:37:55.347076893 CET	52412	13566	192.168.2.13	83.222.87.146
Jan 19, 2025 03:37:55.347084999 CET	39262	13566	192.168.2.13	83.222.198.240
Jan 19, 2025 03:37:55.347094059 CET	38226	13566	192.168.2.13	83.222.26.164
Jan 19, 2025 03:37:55.347107887 CET	43350	13566	192.168.2.13	83.222.152.236
Jan 19, 2025 03:37:55.347124100 CET	57900	13566	192.168.2.13	83.222.91.217
Jan 19, 2025 03:37:55.347131968 CET	42796	13566	192.168.2.13	83.222.159.196
Jan 19, 2025 03:37:55.347165108 CET	35972	13566	192.168.2.13	83.222.152.90
Jan 19, 2025 03:37:55.347184896 CET	49638	13566	192.168.2.13	83.222.79.200
Jan 19, 2025 03:37:55.347186089 CET	45434	13566	192.168.2.13	83.222.143.88
Jan 19, 2025 03:37:55.347198009 CET	59150	13566	192.168.2.13	83.222.234.116
Jan 19, 2025 03:37:55.347212076 CET	51342	13566	192.168.2.13	83.222.178.219
Jan 19, 2025 03:37:55.347259045 CET	55704	13566	192.168.2.13	83.222.11.156
Jan 19, 2025 03:37:55.347259045 CET	42746	13566	192.168.2.13	83.222.159.198
Jan 19, 2025 03:37:55.347305059 CET	48792	13566	192.168.2.13	83.222.253.133
Jan 19, 2025 03:37:55.347332954 CET	34972	13566	192.168.2.13	83.222.127.84
Jan 19, 2025 03:37:55.347340107 CET	34504	13566	192.168.2.13	83.222.104.80
Jan 19, 2025 03:37:55.347362041 CET	54478	13566	192.168.2.13	83.222.69.49
Jan 19, 2025 03:37:55.347362041 CET	43264	13566	192.168.2.13	83.222.23.70
Jan 19, 2025 03:37:55.347398043 CET	36542	13566	192.168.2.13	83.222.234.221
Jan 19, 2025 03:37:55.347400904 CET	40490	13566	192.168.2.13	83.222.29.69
Jan 19, 2025 03:37:55.347409964 CET	41544	13566	192.168.2.13	83.222.182.189
Jan 19, 2025 03:37:55.347429037 CET	53104	13566	192.168.2.13	83.222.10.78
Jan 19, 2025 03:37:55.347440958 CET	57162	13566	192.168.2.13	83.222.23.89
Jan 19, 2025 03:37:55.347464085 CET	58146	13566	192.168.2.13	83.222.22.166
Jan 19, 2025 03:37:55.347501040 CET	35922	13566	192.168.2.13	83.222.177.1
Jan 19, 2025 03:37:55.347506046 CET	57406	13566	192.168.2.13	83.222.26.99
Jan 19, 2025 03:37:55.347512960 CET	35816	13566	192.168.2.13	83.222.220.37
Jan 19, 2025 03:37:55.347528934 CET	57168	13566	192.168.2.13	83.222.255.124
Jan 19, 2025 03:37:55.347544909 CET	35282	13566	192.168.2.13	83.222.235.104
Jan 19, 2025 03:37:55.347551107 CET	40458	13566	192.168.2.13	83.222.204.232
Jan 19, 2025 03:37:55.347568989 CET	45218	13566	192.168.2.13	83.222.237.76
Jan 19, 2025 03:37:55.347585917 CET	56808	13566	192.168.2.13	83.222.60.5
Jan 19, 2025 03:37:55.347601891 CET	43640	13566	192.168.2.13	83.222.146.129
Jan 19, 2025 03:37:55.347609043 CET	57686	13566	192.168.2.13	83.222.54.124
Jan 19, 2025 03:37:55.347623110 CET	50412	13566	192.168.2.13	83.222.94.84
Jan 19, 2025 03:37:55.347632885 CET	46422	13566	192.168.2.13	83.222.193.21
Jan 19, 2025 03:37:55.347655058 CET	48448	13566	192.168.2.13	83.222.17.203
Jan 19, 2025 03:37:55.347661972 CET	44082	13566	192.168.2.13	83.222.99.40
Jan 19, 2025 03:37:55.347673893 CET	52320	13566	192.168.2.13	83.222.36.122
Jan 19, 2025 03:37:55.347688913 CET	48406	13566	192.168.2.13	83.222.206.213
Jan 19, 2025 03:37:55.347701073 CET	54550	13566	192.168.2.13	83.222.123.232
Jan 19, 2025 03:37:55.347723007 CET	53358	13566	192.168.2.13	83.222.57.87
Jan 19, 2025 03:37:55.347727060 CET	55842	13566	192.168.2.13	83.222.13.56
Jan 19, 2025 03:37:55.347727060 CET	40988	13566	192.168.2.13	83.222.211.248
Jan 19, 2025 03:37:55.347747087 CET	50918	13566	192.168.2.13	83.222.160.160
Jan 19, 2025 03:37:55.351356983 CET	13566	34304	83.222.103.245	192.168.2.13
Jan 19, 2025 03:37:55.351392984 CET	13566	37008	83.222.87.142	192.168.2.13
Jan 19, 2025 03:37:55.351422071 CET	13566	49554	83.222.78.237	192.168.2.13
Jan 19, 2025 03:37:55.351447105 CET	37008	13566	192.168.2.13	83.222.87.142
Jan 19, 2025 03:37:55.351458073 CET	13566	44210	83.222.204.106	192.168.2.13
Jan 19, 2025 03:37:55.351464987 CET	49554	13566	192.168.2.13	83.222.78.237
Jan 19, 2025 03:37:55.351464987 CET	34304	13566	192.168.2.13	83.222.103.245
Jan 19, 2025 03:37:55.351490021 CET	13566	38980	83.222.96.67	192.168.2.13
Jan 19, 2025 03:37:55.351517916 CET	13566	34758	83.222.152.17	192.168.2.13
Jan 19, 2025 03:37:55.351531982 CET	13566	47668	83.222.230.25	192.168.2.13
Jan 19, 2025 03:37:55.351543903 CET	13566	49002	83.222.119.76	192.168.2.13
Jan 19, 2025 03:37:55.351556063 CET	13566	54174	83.222.140.194	192.168.2.13
Jan 19, 2025 03:37:55.351560116 CET	44210	13566	192.168.2.13	83.222.204.106
Jan 19, 2025 03:37:55.351567984 CET	13566	48274	83.222.118.91	192.168.2.13
Jan 19, 2025 03:37:55.351598978 CET	38980	13566	192.168.2.13	83.222.96.67
Jan 19, 2025 03:37:55.351614952 CET	47668	13566	192.168.2.13	83.222.230.25
Jan 19, 2025 03:37:55.351619959 CET	49002	13566	192.168.2.13	83.222.119.76
Jan 19, 2025 03:37:55.351627111 CET	34758	13566	192.168.2.13	83.222.152.17
Jan 19, 2025 03:37:55.351628065 CET	54174	13566	192.168.2.13	83.222.140.194
Jan 19, 2025 03:37:55.351628065 CET	48274	13566	192.168.2.13	83.222.118.91
Jan 19, 2025 03:37:55.356249094 CET	13566	51110	83.222.183.136	192.168.2.13
Jan 19, 2025 03:37:55.356277943 CET	13566	51950	83.222.212.238	192.168.2.13
Jan 19, 2025 03:37:55.356287956 CET	51110	13566	192.168.2.13	83.222.183.136
Jan 19, 2025 03:37:55.356307030 CET	13566	43642	83.222.44.150	192.168.2.13
Jan 19, 2025 03:37:55.356318951 CET	51950	13566	192.168.2.13	83.222.212.238
Jan 19, 2025 03:37:55.356338024 CET	13566	44324	83.222.55.148	192.168.2.13
Jan 19, 2025 03:37:55.356348991 CET	43642	13566	192.168.2.13	83.222.44.150
Jan 19, 2025 03:37:55.356368065 CET	13566	35244	83.222.139.151	192.168.2.13
Jan 19, 2025 03:37:55.356381893 CET	44324	13566	192.168.2.13	83.222.55.148
Jan 19, 2025 03:37:55.356395960 CET	35244	13566	192.168.2.13	83.222.139.151
Jan 19, 2025 03:37:55.356398106 CET	13566	41192	83.222.40.112	192.168.2.13
Jan 19, 2025 03:37:55.356427908 CET	13566	37576	83.222.22.21	192.168.2.13
Jan 19, 2025 03:37:55.356441021 CET	41192	13566	192.168.2.13	83.222.40.112
Jan 19, 2025 03:37:55.356456995 CET	13566	55260	83.222.244.115	192.168.2.13
Jan 19, 2025 03:37:55.356461048 CET	37576	13566	192.168.2.13	83.222.22.21
Jan 19, 2025 03:37:55.356484890 CET	13566	53804	83.222.93.129	192.168.2.13
Jan 19, 2025 03:37:55.356493950 CET	55260	13566	192.168.2.13	83.222.244.115
Jan 19, 2025 03:37:55.356514931 CET	13566	44262	83.222.215.227	192.168.2.13
Jan 19, 2025 03:37:55.356523037 CET	53804	13566	192.168.2.13	83.222.93.129
Jan 19, 2025 03:37:55.356544018 CET	13566	56550	83.222.53.211	192.168.2.13
Jan 19, 2025 03:37:55.356563091 CET	44262	13566	192.168.2.13	83.222.215.227
Jan 19, 2025 03:37:55.356623888 CET	13566	39152	83.222.37.112	192.168.2.13
Jan 19, 2025 03:37:55.356640100 CET	56550	13566	192.168.2.13	83.222.53.211
Jan 19, 2025 03:37:55.356652021 CET	13566	33000	83.222.220.2	192.168.2.13
Jan 19, 2025 03:37:55.356671095 CET	39152	13566	192.168.2.13	83.222.37.112
Jan 19, 2025 03:37:55.356679916 CET	13566	45744	83.222.61.4	192.168.2.13
Jan 19, 2025 03:37:55.356693983 CET	33000	13566	192.168.2.13	83.222.220.2
Jan 19, 2025 03:37:55.356709003 CET	13566	34956	83.222.26.88	192.168.2.13
Jan 19, 2025 03:37:55.356730938 CET	45744	13566	192.168.2.13	83.222.61.4
Jan 19, 2025 03:37:55.356739044 CET	13566	42452	83.222.114.84	192.168.2.13
Jan 19, 2025 03:37:55.356748104 CET	34956	13566	192.168.2.13	83.222.26.88
Jan 19, 2025 03:37:55.356767893 CET	13566	41226	83.222.164.36	192.168.2.13
Jan 19, 2025 03:37:55.356789112 CET	42452	13566	192.168.2.13	83.222.114.84
Jan 19, 2025 03:37:55.356796980 CET	13566	57386	83.222.25.120	192.168.2.13
Jan 19, 2025 03:37:55.356812000 CET	41226	13566	192.168.2.13	83.222.164.36
Jan 19, 2025 03:37:55.356842995 CET	57386	13566	192.168.2.13	83.222.25.120
Jan 19, 2025 03:37:55.356853008 CET	13566	38164	83.222.19.70	192.168.2.13
Jan 19, 2025 03:37:55.356894970 CET	13566	47894	83.222.109.145	192.168.2.13
Jan 19, 2025 03:37:55.356895924 CET	38164	13566	192.168.2.13	83.222.19.70
Jan 19, 2025 03:37:55.356924057 CET	13566	47528	83.222.218.154	192.168.2.13
Jan 19, 2025 03:37:55.356940031 CET	47894	13566	192.168.2.13	83.222.109.145
Jan 19, 2025 03:37:55.356952906 CET	13566	51596	83.222.225.177	192.168.2.13
Jan 19, 2025 03:37:55.356956005 CET	47528	13566	192.168.2.13	83.222.218.154
Jan 19, 2025 03:37:55.356981993 CET	13566	43758	83.222.14.74	192.168.2.13
Jan 19, 2025 03:37:55.356987953 CET	51596	13566	192.168.2.13	83.222.225.177
Jan 19, 2025 03:37:55.357011080 CET	13566	53792	83.222.33.113	192.168.2.13
Jan 19, 2025 03:37:55.357021093 CET	43758	13566	192.168.2.13	83.222.14.74
Jan 19, 2025 03:37:55.357040882 CET	13566	43320	83.222.125.7	192.168.2.13
Jan 19, 2025 03:37:55.357048988 CET	53792	13566	192.168.2.13	83.222.33.113
Jan 19, 2025 03:37:55.357069016 CET	13566	43346	83.222.122.126	192.168.2.13
Jan 19, 2025 03:37:55.357084036 CET	43320	13566	192.168.2.13	83.222.125.7
Jan 19, 2025 03:37:55.357098103 CET	13566	39494	83.222.242.176	192.168.2.13
Jan 19, 2025 03:37:55.357111931 CET	43346	13566	192.168.2.13	83.222.122.126
Jan 19, 2025 03:37:55.357126951 CET	13566	44232	83.222.81.206	192.168.2.13
Jan 19, 2025 03:37:55.357132912 CET	39494	13566	192.168.2.13	83.222.242.176
Jan 19, 2025 03:37:55.357156992 CET	13566	34198	83.222.178.143	192.168.2.13
Jan 19, 2025 03:37:55.357182980 CET	44232	13566	192.168.2.13	83.222.81.206
Jan 19, 2025 03:37:55.357184887 CET	13566	49976	83.222.227.237	192.168.2.13
Jan 19, 2025 03:37:55.357192993 CET	34198	13566	192.168.2.13	83.222.178.143
Jan 19, 2025 03:37:55.357213974 CET	13566	51224	83.222.211.36	192.168.2.13
Jan 19, 2025 03:37:55.357223988 CET	49976	13566	192.168.2.13	83.222.227.237
Jan 19, 2025 03:37:55.357243061 CET	13566	35464	83.222.124.80	192.168.2.13
Jan 19, 2025 03:37:55.357258081 CET	51224	13566	192.168.2.13	83.222.211.36
Jan 19, 2025 03:37:55.357270956 CET	13566	47122	83.222.126.32	192.168.2.13
Jan 19, 2025 03:37:55.357285976 CET	35464	13566	192.168.2.13	83.222.124.80
Jan 19, 2025 03:37:55.357300043 CET	13566	55540	83.222.153.136	192.168.2.13
Jan 19, 2025 03:37:55.357320070 CET	47122	13566	192.168.2.13	83.222.126.32
Jan 19, 2025 03:37:55.357328892 CET	13566	47060	83.222.210.183	192.168.2.13
Jan 19, 2025 03:37:55.357352972 CET	55540	13566	192.168.2.13	83.222.153.136
Jan 19, 2025 03:37:55.357357025 CET	13566	53186	83.222.221.167	192.168.2.13
Jan 19, 2025 03:37:55.357372046 CET	47060	13566	192.168.2.13	83.222.210.183
Jan 19, 2025 03:37:55.357387066 CET	13566	42508	83.222.117.151	192.168.2.13
Jan 19, 2025 03:37:55.357398987 CET	53186	13566	192.168.2.13	83.222.221.167
Jan 19, 2025 03:37:55.357425928 CET	42508	13566	192.168.2.13	83.222.117.151
Jan 19, 2025 03:37:55.357438087 CET	13566	37468	83.222.65.179	192.168.2.13
Jan 19, 2025 03:37:55.357474089 CET	37468	13566	192.168.2.13	83.222.65.179
Jan 19, 2025 03:37:55.357480049 CET	13566	54558	83.222.105.190	192.168.2.13
Jan 19, 2025 03:37:55.357507944 CET	13566	45090	83.222.186.138	192.168.2.13
Jan 19, 2025 03:37:55.357518911 CET	54558	13566	192.168.2.13	83.222.105.190
Jan 19, 2025 03:37:55.357537985 CET	13566	39204	83.222.48.53	192.168.2.13
Jan 19, 2025 03:37:55.357551098 CET	45090	13566	192.168.2.13	83.222.186.138
Jan 19, 2025 03:37:55.357567072 CET	13566	46648	83.222.9.34	192.168.2.13
Jan 19, 2025 03:37:55.357590914 CET	39204	13566	192.168.2.13	83.222.48.53
Jan 19, 2025 03:37:55.357595921 CET	13566	56230	83.222.229.90	192.168.2.13
Jan 19, 2025 03:37:55.357624054 CET	13566	48454	83.222.241.151	192.168.2.13
Jan 19, 2025 03:37:55.357631922 CET	46648	13566	192.168.2.13	83.222.9.34
Jan 19, 2025 03:37:55.357636929 CET	56230	13566	192.168.2.13	83.222.229.90
Jan 19, 2025 03:37:55.357651949 CET	13566	38462	83.222.233.196	192.168.2.13
Jan 19, 2025 03:37:55.357670069 CET	48454	13566	192.168.2.13	83.222.241.151
Jan 19, 2025 03:37:55.357680082 CET	13566	37288	83.222.177.55	192.168.2.13
Jan 19, 2025 03:37:55.357703924 CET	38462	13566	192.168.2.13	83.222.233.196
Jan 19, 2025 03:37:55.357709885 CET	13566	38178	83.222.187.204	192.168.2.13
Jan 19, 2025 03:37:55.357712984 CET	37288	13566	192.168.2.13	83.222.177.55
Jan 19, 2025 03:37:55.357738018 CET	13566	48802	83.222.29.47	192.168.2.13
Jan 19, 2025 03:37:55.357759953 CET	38178	13566	192.168.2.13	83.222.187.204
Jan 19, 2025 03:37:55.357767105 CET	13566	52412	83.222.87.146	192.168.2.13
Jan 19, 2025 03:37:55.357800961 CET	48802	13566	192.168.2.13	83.222.29.47
Jan 19, 2025 03:37:55.357804060 CET	13566	39262	83.222.198.240	192.168.2.13
Jan 19, 2025 03:37:55.357805967 CET	52412	13566	192.168.2.13	83.222.87.146
Jan 19, 2025 03:37:55.357832909 CET	13566	38226	83.222.26.164	192.168.2.13
Jan 19, 2025 03:37:55.357856989 CET	39262	13566	192.168.2.13	83.222.198.240
Jan 19, 2025 03:37:55.357860088 CET	13566	43350	83.222.152.236	192.168.2.13
Jan 19, 2025 03:37:55.357882023 CET	38226	13566	192.168.2.13	83.222.26.164
Jan 19, 2025 03:37:55.357888937 CET	13566	57900	83.222.91.217	192.168.2.13
Jan 19, 2025 03:37:55.357897997 CET	43350	13566	192.168.2.13	83.222.152.236
Jan 19, 2025 03:37:55.357916117 CET	13566	42796	83.222.159.196	192.168.2.13
Jan 19, 2025 03:37:55.357933998 CET	57900	13566	192.168.2.13	83.222.91.217
Jan 19, 2025 03:37:55.357943058 CET	13566	35972	83.222.152.90	192.168.2.13
Jan 19, 2025 03:37:55.357959986 CET	42796	13566	192.168.2.13	83.222.159.196
Jan 19, 2025 03:37:55.357969999 CET	13566	45434	83.222.143.88	192.168.2.13
Jan 19, 2025 03:37:55.357984066 CET	35972	13566	192.168.2.13	83.222.152.90
Jan 19, 2025 03:37:55.358000994 CET	13566	49638	83.222.79.200	192.168.2.13
Jan 19, 2025 03:37:55.358006001 CET	45434	13566	192.168.2.13	83.222.143.88
Jan 19, 2025 03:37:55.358036995 CET	13566	59150	83.222.234.116	192.168.2.13
Jan 19, 2025 03:37:55.358045101 CET	49638	13566	192.168.2.13	83.222.79.200
Jan 19, 2025 03:37:55.358064890 CET	13566	51342	83.222.178.219	192.168.2.13
Jan 19, 2025 03:37:55.358069897 CET	59150	13566	192.168.2.13	83.222.234.116
Jan 19, 2025 03:37:55.358099937 CET	13566	55704	83.222.11.156	192.168.2.13
Jan 19, 2025 03:37:55.358107090 CET	51342	13566	192.168.2.13	83.222.178.219
Jan 19, 2025 03:37:55.358128071 CET	13566	42746	83.222.159.198	192.168.2.13
Jan 19, 2025 03:37:55.358141899 CET	55704	13566	192.168.2.13	83.222.11.156
Jan 19, 2025 03:37:55.358155966 CET	13566	48792	83.222.253.133	192.168.2.13
Jan 19, 2025 03:37:55.358169079 CET	42746	13566	192.168.2.13	83.222.159.198
Jan 19, 2025 03:37:55.358184099 CET	13566	34972	83.222.127.84	192.168.2.13
Jan 19, 2025 03:37:55.358198881 CET	48792	13566	192.168.2.13	83.222.253.133
Jan 19, 2025 03:37:55.358211994 CET	13566	34504	83.222.104.80	192.168.2.13
Jan 19, 2025 03:37:55.358222961 CET	34972	13566	192.168.2.13	83.222.127.84
Jan 19, 2025 03:37:55.358241081 CET	13566	54478	83.222.69.49	192.168.2.13
Jan 19, 2025 03:37:55.358268976 CET	13566	43264	83.222.23.70	192.168.2.13
Jan 19, 2025 03:37:55.358272076 CET	34504	13566	192.168.2.13	83.222.104.80
Jan 19, 2025 03:37:55.358273029 CET	54478	13566	192.168.2.13	83.222.69.49
Jan 19, 2025 03:37:55.358297110 CET	13566	40490	83.222.29.69	192.168.2.13
Jan 19, 2025 03:37:55.358299971 CET	43264	13566	192.168.2.13	83.222.23.70
Jan 19, 2025 03:37:55.358325005 CET	13566	36542	83.222.234.221	192.168.2.13
Jan 19, 2025 03:37:55.358338118 CET	40490	13566	192.168.2.13	83.222.29.69
Jan 19, 2025 03:37:55.358354092 CET	13566	41544	83.222.182.189	192.168.2.13
Jan 19, 2025 03:37:55.358366013 CET	36542	13566	192.168.2.13	83.222.234.221
Jan 19, 2025 03:37:55.358381033 CET	13566	53104	83.222.10.78	192.168.2.13
Jan 19, 2025 03:37:55.358386993 CET	41544	13566	192.168.2.13	83.222.182.189
Jan 19, 2025 03:37:55.358407974 CET	13566	57162	83.222.23.89	192.168.2.13
Jan 19, 2025 03:37:55.358417034 CET	53104	13566	192.168.2.13	83.222.10.78
Jan 19, 2025 03:37:55.358437061 CET	13566	58146	83.222.22.166	192.168.2.13
Jan 19, 2025 03:37:55.358452082 CET	57162	13566	192.168.2.13	83.222.23.89
Jan 19, 2025 03:37:55.358467102 CET	13566	57406	83.222.26.99	192.168.2.13
Jan 19, 2025 03:37:55.358474970 CET	58146	13566	192.168.2.13	83.222.22.166
Jan 19, 2025 03:37:55.358495951 CET	13566	35922	83.222.177.1	192.168.2.13
Jan 19, 2025 03:37:55.358503103 CET	57406	13566	192.168.2.13	83.222.26.99
Jan 19, 2025 03:37:55.358524084 CET	13566	35816	83.222.220.37	192.168.2.13
Jan 19, 2025 03:37:55.358542919 CET	35922	13566	192.168.2.13	83.222.177.1
Jan 19, 2025 03:37:55.358556032 CET	13566	57168	83.222.255.124	192.168.2.13
Jan 19, 2025 03:37:55.358565092 CET	35816	13566	192.168.2.13	83.222.220.37
Jan 19, 2025 03:37:55.358596087 CET	13566	35282	83.222.235.104	192.168.2.13
Jan 19, 2025 03:37:55.358597040 CET	57168	13566	192.168.2.13	83.222.255.124
Jan 19, 2025 03:37:55.358623981 CET	13566	40458	83.222.204.232	192.168.2.13
Jan 19, 2025 03:37:55.358632088 CET	35282	13566	192.168.2.13	83.222.235.104
Jan 19, 2025 03:37:55.358652115 CET	13566	45218	83.222.237.76	192.168.2.13
Jan 19, 2025 03:37:55.358659983 CET	40458	13566	192.168.2.13	83.222.204.232
Jan 19, 2025 03:37:55.358680964 CET	13566	56808	83.222.60.5	192.168.2.13
Jan 19, 2025 03:37:55.358694077 CET	45218	13566	192.168.2.13	83.222.237.76
Jan 19, 2025 03:37:55.358709097 CET	13566	43640	83.222.146.129	192.168.2.13
Jan 19, 2025 03:37:55.358724117 CET	56808	13566	192.168.2.13	83.222.60.5
Jan 19, 2025 03:37:55.358737946 CET	13566	57686	83.222.54.124	192.168.2.13
Jan 19, 2025 03:37:55.358756065 CET	43640	13566	192.168.2.13	83.222.146.129
Jan 19, 2025 03:37:55.358767986 CET	13566	50412	83.222.94.84	192.168.2.13
Jan 19, 2025 03:37:55.358778954 CET	57686	13566	192.168.2.13	83.222.54.124
Jan 19, 2025 03:37:55.358795881 CET	13566	46422	83.222.193.21	192.168.2.13
Jan 19, 2025 03:37:55.358812094 CET	50412	13566	192.168.2.13	83.222.94.84
Jan 19, 2025 03:37:55.358825922 CET	13566	48448	83.222.17.203	192.168.2.13
Jan 19, 2025 03:37:55.358848095 CET	46422	13566	192.168.2.13	83.222.193.21
Jan 19, 2025 03:37:55.358854055 CET	13566	44082	83.222.99.40	192.168.2.13
Jan 19, 2025 03:37:55.358881950 CET	13566	52320	83.222.36.122	192.168.2.13
Jan 19, 2025 03:37:55.358886003 CET	48448	13566	192.168.2.13	83.222.17.203
Jan 19, 2025 03:37:55.358891964 CET	44082	13566	192.168.2.13	83.222.99.40
Jan 19, 2025 03:37:55.358911037 CET	13566	48406	83.222.206.213	192.168.2.13
Jan 19, 2025 03:37:55.358918905 CET	52320	13566	192.168.2.13	83.222.36.122
Jan 19, 2025 03:37:55.358937979 CET	13566	54550	83.222.123.232	192.168.2.13
Jan 19, 2025 03:37:55.358948946 CET	48406	13566	192.168.2.13	83.222.206.213
Jan 19, 2025 03:37:55.358966112 CET	13566	53358	83.222.57.87	192.168.2.13
Jan 19, 2025 03:37:55.358982086 CET	54550	13566	192.168.2.13	83.222.123.232
Jan 19, 2025 03:37:55.358994007 CET	13566	55842	83.222.13.56	192.168.2.13
Jan 19, 2025 03:37:55.358994007 CET	53358	13566	192.168.2.13	83.222.57.87
Jan 19, 2025 03:37:55.359024048 CET	13566	40988	83.222.211.248	192.168.2.13
Jan 19, 2025 03:37:55.359028101 CET	55842	13566	192.168.2.13	83.222.13.56
Jan 19, 2025 03:37:55.359054089 CET	13566	50918	83.222.160.160	192.168.2.13
Jan 19, 2025 03:37:55.359069109 CET	40988	13566	192.168.2.13	83.222.211.248
Jan 19, 2025 03:37:55.359100103 CET	50918	13566	192.168.2.13	83.222.160.160
Jan 19, 2025 03:37:55.361377001 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:37:55.366216898 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:37:55.366266966 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:37:55.366785049 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:37:55.371660948 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:37:55.371702909 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:37:55.376549959 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:38:05.375456095 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:38:05.381164074 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:38:05.577963114 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:38:05.578217030 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:38:05.940383911 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:38:05.940448999 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:39:05.990417004 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:39:05.995657921 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:39:06.192183971 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:39:06.192257881 CET	42868	13566	192.168.2.13	83.222.191.90
Jan 19, 2025 03:39:06.940221071 CET	13566	42868	83.222.191.90	192.168.2.13
Jan 19, 2025 03:39:06.940340042 CET	42868	13566	192.168.2.13	83.222.191.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2025 03:37:55.347783089 CET	53269	53	192.168.2.13	8.8.8.8
Jan 19, 2025 03:37:55.361305952 CET	53	53269	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 19, 2025 03:37:55.347783089 CET	192.168.2.13	8.8.8.8	0xc9d8	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 19, 2025 03:37:55.361305952 CET	8.8.8.8	192.168.2.13	0xc9d8	No error (0)	secure-network-rebirthltd.ru		83.222.191.90	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Kloki.i686.elf PID: 5433, Parent PID: 5355

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.i686.elf
Arguments:	/tmp/Kloki.i686.elf
File size:	58512 bytes
MD5 hash:	402f0360f10fb6a1e4fa5db07ea2097e

File Activities

File Opened

File Moved

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: Kloki.i686.elf PID: 5434, Parent PID: 5433

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.i686.elf
Arguments:	-
File size:	58512 bytes
MD5 hash:	402f0360f10fb6a1e4fa5db07ea2097e

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Chronological Activities

Analysis Process: Kloki.i686.elf PID: 5435, Parent PID: 5433

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.i686.elf
Arguments:	-
File size:	58512 bytes
MD5 hash:	402f0360f10fb6a1e4fa5db07ea2097e

Process Activities

Process Forked

Chronological Activities

Analysis Process: Kloki.i686.elf PID: 5436, Parent PID: 5435

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/tmp/Kloki.i686.elf
Arguments:	-
File size:	58512 bytes
MD5 hash:	402f0360f10fb6a1e4fa5db07ea2097e

File Activities

File Opened

Directory Enumerated

Process Activities

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: gnome-session-binary PID: 5437, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5437, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gsd-rfkill PID: 5437, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gnome-session-binary PID: 5459, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5459, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gnome-shell PID: 5459, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

File Activities

File Opened

Chronological Activities

Analysis Process: gnome-session-binary PID: 5461, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5461, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gsd-sharing PID: 5461, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gsd-sharing
Arguments:	/usr/libexec/gsd-sharing
File size:	35424 bytes
MD5 hash:	e29d9025d98590fbb69f89fdbd4438b3

Analysis Process: gnome-session-binary PID: 5462, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5462, Parent PID: 1588

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gdm3 PID: 5463, Parent PID: 1400

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 5463, Parent PID: 1400

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gdm3 PID: 5464, Parent PID: 1400

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 5464, Parent PID: 1400

General

Start time (UTC):	02:37:54
Start date (UTC):	19/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: systemd PID: 5475, Parent PID: 1

General

Start time (UTC):	02:38:04
Start date (UTC):	19/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: systemd-user-runtime-dir PID: 5475, Parent PID: 1

General

Start time (UTC):	02:38:04
Start date (UTC):	19/01/2025
Path:	/lib/systemd/systemd-user-runtime-dir
Arguments:	/lib/systemd/systemd-user-runtime-dir stop 127
File size:	22672 bytes
MD5 hash:	d55f4b0847f88131dbcfb07435178e54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Kloki.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Kloki.i686.elf PID: 5433, Parent PID: 5355

General

File Activities

File Opened

File Moved

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: Kloki.i686.elf PID: 5434, Parent PID: 5433

General

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Chronological Activities

Analysis Process: Kloki.i686.elf PID: 5435, Parent PID: 5433

General

Process Activities

Process Forked

Chronological Activities

Linux Analysis Report
Kloki.i686.elf