Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.arm.elf
Analysis ID:	1617277
MD5:	3ccade8fe55b4412cf1da123cb3ee017
SHA1:	11be314fff09408b69351cf7e2f86a5e48c9e963
SHA256:	93fe69df3932729e18e78276bd31e67a5873efb5569cea08b73965da99de06e1
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617277
Start date and time:	2025-02-17 17:22:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.arm.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
PID:	5434
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434, Parent: 5359, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5438, Parent: 5434)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5440, Parent: 5438)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5442, Parent: 5438)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5456, Parent: 5434)

ub8ehJSePAfc9FYqZIT6.arm.elf New Fork (PID: 5458, Parent: 5434)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5456.1.00007f2488017000.00007f248802c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5456.1.00007f2488017000.00007f248802c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5440.1.00007f2488017000.00007f248802c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5440.1.00007f2488017000.00007f248802c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5434.1.00007f2488017000.00007f248802c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5434.1.00007f2488017000.00007f248802c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5438.1.00007f2488017000.00007f248802c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5438.1.00007f2488017000.00007f248802c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x366:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x406:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x442:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x456:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x285e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x285f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2860c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28620:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2865c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x286ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x286c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x286d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x286e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x286fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2874c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1209:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1231:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1245:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1259:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1295:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1321:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1335:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1349:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1371:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x785:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x799:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x811:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x825:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x839:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x861:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x875:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x889:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x901:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x915:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.arm.elf	Virustotal: Detection: 26%			Perma Link
Source: ub8ehJSePAfc9FYqZIT6.arm.elf	ReversingLabs: Detection: 33%

Source: global traffic

TCP traffic: 192.168.2.13:56038 -> 61.7.209.115:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115

Source: ub8ehJSePAfc9FYqZIT6.arm.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5456.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5440.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5438.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5456.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5440.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5438.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/5023/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/5381/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/5277/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)	File opened: /proc/30/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm.elf

Submission file: segment LOAD with 7.9703 entropy (max. 8.0)

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm.elf (PID: 5434)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5434.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5438.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5456.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/ub8ehJSePAfc9FYqZIT6.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5434.1.0000563b0dc35000.0000563b0dde5000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5438.1.0000563b0dc35000.0000563b0ddc3000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.0000563b0dc35000.0000563b0ddc3000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5456.1.0000563b0dc35000.0000563b0dde5000.rw-.sdmp	Binary or memory string: ;V!/etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5434.1.0000563b0dc35000.0000563b0dde5000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5438.1.0000563b0dc35000.0000563b0ddc3000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.0000563b0dc35000.0000563b0ddc3000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5456.1.0000563b0dc35000.0000563b0dde5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm.elf, 5434.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5438.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5440.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm.elf, 5456.1.00007ffd62b23000.00007ffd62b44000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5456.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5456.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f2488017000.00007f248802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.arm.elf	27%	Virustotal		Browse
ub8ehJSePAfc9FYqZIT6.arm.elf	33%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.arm.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
61.7.209.115	unknown	Thailand		9931	CAT-APTheCommunicationAuthoityofThailandCATTH	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
61.7.209.115	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CAT-APTheCommunicationAuthoityofThailandCATTH	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	61.7.209.115
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	122.155.121.49
	.Sarm5.elf	Get hash	malicious	Mirai	Browse	61.19.165.82
	https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	Get hash	malicious	Unknown	Browse	61.19.254.8
	m68k.elf	Get hash	malicious	Unknown	Browse	122.155.121.43
	3.elf	Get hash	malicious	Unknown	Browse	122.155.39.113
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	122.155.121.187
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	202.129.40.184
	spc.elf	Get hash	malicious	Mirai	Browse	110.78.81.185
	botx.spc.elf	Get hash	malicious	Mirai	Browse	122.155.39.115

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.968487394508077
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ub8ehJSePAfc9FYqZIT6.arm.elf
File size:	39'296 bytes
MD5:	3ccade8fe55b4412cf1da123cb3ee017
SHA1:	11be314fff09408b69351cf7e2f86a5e48c9e963
SHA256:	93fe69df3932729e18e78276bd31e67a5873efb5569cea08b73965da99de06e1
SHA512:	29d8e8a046d5880a863c2d3a33ff3b08271875364fd72522a256b7e3f10c3eab76efe8327590dd228999157364287b2bf00d7b35c20e202d4b979e5952f97a9b
SSDEEP:	768:tu7RATMUu4f7RDdP6NM8I52VNbvdFsDJ4rH/Ks3UozON:aRAC4fNDdP6N5pd+DIfzON
TLSH:	8C03F1C6799BD112DC604930AF7F18177B17BABCC1DB3028A1250635BAD178B752CBAA
File Content Preview:	.ELF...a..........(.........4...........4. ...(....................._..._................{...{...{..................Q.td............................s.y.UPX!.........T...T......S..........?.E.h;.}...^..........fK..z..,vU...].XLU..0.)..0(7n..V5.'...,;.q9...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x106b0
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x985f	0x985f	7.9703	0x5	R E	0x8000
LOAD	0x7bc8	0x27bc8	0x27bc8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 17:23:20.642962933 CET	56038	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:20.647835970 CET	3778	56038	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:20.647910118 CET	56038	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:20.662789106 CET	56038	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:20.667599916 CET	3778	56038	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:20.667659044 CET	56038	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:20.672430038 CET	3778	56038	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:21.658118963 CET	3778	56038	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:21.658612013 CET	56038	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:21.658612013 CET	56038	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:21.659471989 CET	56040	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:21.665342093 CET	3778	56040	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:21.665417910 CET	56040	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:21.666892052 CET	56040	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:21.672569990 CET	3778	56040	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:21.672918081 CET	56040	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:21.678766966 CET	3778	56040	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:22.736540079 CET	3778	56040	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:22.736679077 CET	56040	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:22.736710072 CET	56040	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:22.739901066 CET	56042	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:22.744760990 CET	3778	56042	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:22.744818926 CET	56042	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:22.746180058 CET	56042	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:22.751204014 CET	3778	56042	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:22.751254082 CET	56042	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:22.756407976 CET	3778	56042	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:23.707566977 CET	3778	56042	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:23.707690954 CET	56042	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:23.707735062 CET	56042	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:23.708317995 CET	56044	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:23.714245081 CET	3778	56044	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:23.714354038 CET	56044	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:23.715193033 CET	56044	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:23.719995022 CET	3778	56044	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:23.720066071 CET	56044	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:23.724838972 CET	3778	56044	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:24.690721989 CET	3778	56044	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:24.690821886 CET	56044	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:24.690892935 CET	56044	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:24.691479921 CET	56046	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:24.696247101 CET	3778	56046	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:24.696295977 CET	56046	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:24.697076082 CET	56046	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:24.701917887 CET	3778	56046	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:24.701972961 CET	56046	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:24.706731081 CET	3778	56046	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:25.675777912 CET	3778	56046	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:25.676012039 CET	56046	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:25.676199913 CET	56046	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:25.676981926 CET	56048	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:25.681761980 CET	3778	56048	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:25.681833982 CET	56048	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:25.683235884 CET	56048	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:25.687977076 CET	3778	56048	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:25.688035011 CET	56048	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:25.692787886 CET	3778	56048	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.576970100 CET	56050	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.748996973 CET	3778	56048	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.749068022 CET	56048	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.749098063 CET	56048	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.750416040 CET	3778	56050	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.750555992 CET	56050	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.758656979 CET	56052	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.762964010 CET	56050	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.763453007 CET	3778	56052	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.763500929 CET	56052	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.765722990 CET	56052	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.767802000 CET	3778	56050	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.767865896 CET	56050	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.770498991 CET	3778	56052	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.770632029 CET	56052	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:26.772701025 CET	3778	56050	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:26.775404930 CET	3778	56052	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.732752085 CET	3778	56050	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.732862949 CET	56050	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.733144045 CET	56050	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.734657049 CET	56054	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.737468958 CET	3778	56052	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.737664938 CET	56052	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.737664938 CET	56052	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.738100052 CET	56056	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.739450932 CET	3778	56054	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.739546061 CET	56054	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.741413116 CET	56054	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.743007898 CET	3778	56056	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.743058920 CET	56056	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.744493008 CET	56056	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.746421099 CET	3778	56054	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.746469975 CET	56054	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.749481916 CET	3778	56056	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.749528885 CET	56056	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:27.751427889 CET	3778	56054	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:27.754446983 CET	3778	56056	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.709264994 CET	3778	56054	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.709424019 CET	56054	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.709511042 CET	56054	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.710063934 CET	56058	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.715852976 CET	3778	56058	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.715903044 CET	56058	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.716715097 CET	56058	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.721487999 CET	3778	56058	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.721533060 CET	56058	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.722549915 CET	3778	56056	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.722600937 CET	56056	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.722625017 CET	56056	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.722973108 CET	56060	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.726366997 CET	3778	56058	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.727776051 CET	3778	56060	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.727855921 CET	56060	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.728683949 CET	56060	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.733442068 CET	3778	56060	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:28.733525038 CET	56060	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:28.738277912 CET	3778	56060	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.694928885 CET	3778	56058	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.695137978 CET	56058	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.695137978 CET	56058	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.695898056 CET	56062	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.700706005 CET	3778	56062	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.700766087 CET	56062	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.701878071 CET	56062	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.702388048 CET	3778	56060	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.702486992 CET	56060	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.702486992 CET	56060	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.702980042 CET	56064	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.706664085 CET	3778	56062	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.706705093 CET	56062	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.707776070 CET	3778	56064	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.707837105 CET	56064	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.708920002 CET	56064	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.711522102 CET	3778	56062	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.713690042 CET	3778	56064	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:29.713737011 CET	56064	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:29.718461990 CET	3778	56064	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.658905983 CET	3778	56062	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.659035921 CET	56062	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.659095049 CET	56062	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.660026073 CET	56066	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.664849043 CET	3778	56066	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.664905071 CET	56066	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.666162014 CET	56066	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.670223951 CET	3778	56064	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.670305967 CET	56064	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.670337915 CET	56064	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.671148062 CET	3778	56066	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.671192884 CET	56066	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.671339035 CET	56068	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.676002979 CET	3778	56066	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.676155090 CET	3778	56068	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.676230907 CET	56068	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.677258015 CET	56068	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.682101965 CET	3778	56068	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:30.682281971 CET	56068	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:30.687089920 CET	3778	56068	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.659890890 CET	3778	56066	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.660017967 CET	56066	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.660062075 CET	56066	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.661068916 CET	56070	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.665915966 CET	3778	56070	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.665992022 CET	56070	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.667182922 CET	56070	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.671497107 CET	3778	56068	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.671574116 CET	56068	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.671598911 CET	56068	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.671962976 CET	3778	56070	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.672015905 CET	56070	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.672092915 CET	56072	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.676762104 CET	3778	56070	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.676856995 CET	3778	56072	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.676919937 CET	56072	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.677997112 CET	56072	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.682759047 CET	3778	56072	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:31.682810068 CET	56072	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:31.687547922 CET	3778	56072	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.654828072 CET	3778	56070	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.655003071 CET	56070	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.655113935 CET	56070	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.655769110 CET	3778	56072	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.655811071 CET	56072	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.655867100 CET	56072	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.655924082 CET	56074	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.656394958 CET	56076	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.660712957 CET	3778	56074	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.660774946 CET	56074	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.661179066 CET	3778	56076	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.661237955 CET	56076	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.662590027 CET	56076	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.662723064 CET	56074	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.667344093 CET	3778	56076	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.667395115 CET	56076	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.667448044 CET	3778	56074	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.667491913 CET	56074	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:32.672139883 CET	3778	56076	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:32.672247887 CET	3778	56074	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.653665066 CET	3778	56074	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.653680086 CET	3778	56076	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.653911114 CET	56074	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.653950930 CET	56076	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.654016972 CET	56074	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.654135942 CET	56076	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.655073881 CET	56078	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.655303001 CET	56080	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.661261082 CET	3778	56078	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.661273956 CET	3778	56080	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.661326885 CET	56078	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.661330938 CET	56080	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.662787914 CET	56078	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.662919044 CET	56080	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.667602062 CET	3778	56078	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.667653084 CET	56078	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.667718887 CET	3778	56080	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.667766094 CET	56080	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:33.672924042 CET	3778	56078	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:33.672934055 CET	3778	56080	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.627696037 CET	3778	56078	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.627835035 CET	56078	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.627891064 CET	56078	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.628577948 CET	56082	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.633364916 CET	3778	56082	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.633450985 CET	56082	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.634459019 CET	56082	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.637677908 CET	3778	56080	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.637738943 CET	56080	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.637765884 CET	56080	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.638154030 CET	56084	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.639245987 CET	3778	56082	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.639290094 CET	56082	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.642947912 CET	3778	56084	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.643023968 CET	56084	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.644037008 CET	3778	56082	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.644148111 CET	56084	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.648922920 CET	3778	56084	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:34.648982048 CET	56084	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:34.653769970 CET	3778	56084	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.599170923 CET	3778	56082	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.599414110 CET	56082	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.599414110 CET	56082	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.600316048 CET	56086	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.605212927 CET	3778	56086	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.605267048 CET	56086	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.606446981 CET	56086	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.611213923 CET	3778	56086	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.611262083 CET	56086	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.616029978 CET	3778	56086	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.634591103 CET	3778	56084	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.634666920 CET	56084	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.634763956 CET	56084	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.635600090 CET	56088	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.640404940 CET	3778	56088	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.640491962 CET	56088	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.641952991 CET	56088	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.646716118 CET	3778	56088	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:35.646780968 CET	56088	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:35.651536942 CET	3778	56088	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.615494013 CET	3778	56086	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.615695000 CET	56086	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.615695000 CET	56086	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.616637945 CET	56090	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.621546984 CET	3778	56090	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.621648073 CET	56090	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.622770071 CET	56090	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.627563953 CET	3778	56090	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.627609968 CET	56090	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.632384062 CET	3778	56090	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.646481991 CET	3778	56088	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.646542072 CET	56088	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.646573067 CET	56088	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.647180080 CET	56092	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.651940107 CET	3778	56092	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.651992083 CET	56092	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.653101921 CET	56092	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.657850027 CET	3778	56092	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:36.657896996 CET	56092	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:36.662750959 CET	3778	56092	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.591082096 CET	3778	56090	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.591207981 CET	56090	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.591294050 CET	56090	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.591948986 CET	56094	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.596868038 CET	3778	56094	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.596942902 CET	56094	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.597877026 CET	56094	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.602698088 CET	3778	56094	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.602747917 CET	56094	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.607567072 CET	3778	56094	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.633130074 CET	3778	56092	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.633264065 CET	56092	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.633364916 CET	56092	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.634043932 CET	56096	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.638911963 CET	3778	56096	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.638982058 CET	56096	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.640281916 CET	56096	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.645122051 CET	3778	56096	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:37.645194054 CET	56096	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:37.650038004 CET	3778	56096	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.581243038 CET	3778	56094	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.581492901 CET	56094	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.581492901 CET	56094	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.582484961 CET	56098	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.587449074 CET	3778	56098	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.587635040 CET	56098	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.588876009 CET	56098	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.593852043 CET	3778	56098	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.593914032 CET	56098	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.598738909 CET	3778	56098	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.621177912 CET	3778	56096	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.621315002 CET	56096	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.621375084 CET	56096	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.621977091 CET	56100	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.626773119 CET	3778	56100	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.626836061 CET	56100	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.628084898 CET	56100	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.632860899 CET	3778	56100	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:38.632910967 CET	56100	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:38.637742996 CET	3778	56100	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.597631931 CET	3778	56098	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.597872972 CET	56098	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.597975016 CET	56098	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.598802090 CET	56102	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.603625059 CET	3778	56102	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.603702068 CET	56102	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.605026007 CET	56102	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.609828949 CET	3778	56102	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.609895945 CET	56102	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.614682913 CET	3778	56102	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.630269051 CET	3778	56100	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.630431890 CET	56100	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.630502939 CET	56100	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.631062984 CET	56104	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.635848045 CET	3778	56104	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.635911942 CET	56104	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.636853933 CET	56104	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.641617060 CET	3778	56104	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:39.641664028 CET	56104	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:39.646450996 CET	3778	56104	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.721239090 CET	3778	56102	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.721353054 CET	56102	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.721376896 CET	56102	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.722091913 CET	56106	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.727539062 CET	3778	56106	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.727643013 CET	56106	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.728799105 CET	56106	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.733648062 CET	3778	56106	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.733714104 CET	56106	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.738527060 CET	3778	56106	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.801254988 CET	3778	56104	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.801367998 CET	56104	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.801423073 CET	56104	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.802213907 CET	56108	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.807070017 CET	3778	56108	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.807118893 CET	56108	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.808515072 CET	56108	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.814214945 CET	3778	56108	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:40.814261913 CET	56108	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:40.819356918 CET	3778	56108	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.758574009 CET	3778	56106	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.758734941 CET	56106	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.758734941 CET	56106	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.759475946 CET	56110	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.764264107 CET	3778	56110	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.764352083 CET	56110	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.765369892 CET	56110	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.770102024 CET	3778	56110	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.770167112 CET	56110	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.774910927 CET	3778	56110	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.846668959 CET	3778	56108	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.846995115 CET	56108	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.846995115 CET	56108	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.847533941 CET	56112	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.852353096 CET	3778	56112	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.852441072 CET	56112	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.853631973 CET	56112	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.858422995 CET	3778	56112	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:41.858516932 CET	56112	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:41.863267899 CET	3778	56112	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.747957945 CET	3778	56110	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.748224974 CET	56110	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.748224974 CET	56110	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.749001980 CET	56114	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.753808022 CET	3778	56114	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.753885031 CET	56114	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.755191088 CET	56114	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.759973049 CET	3778	56114	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.760044098 CET	56114	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.764803886 CET	3778	56114	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.831726074 CET	3778	56112	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.831852913 CET	56112	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.831942081 CET	56112	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.832698107 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.837575912 CET	3778	56116	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.837682962 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.839138985 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.843883991 CET	3778	56116	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:42.843956947 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:42.848809004 CET	3778	56116	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.761027098 CET	3778	56114	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.761207104 CET	56114	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.761281967 CET	56114	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.762411118 CET	56118	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.767266035 CET	3778	56118	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.767342091 CET	56118	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.768835068 CET	56118	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.773677111 CET	3778	56118	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.773744106 CET	56118	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.971189022 CET	3778	56116	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.971376896 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.971591949 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.971836090 CET	3778	56116	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.971937895 CET	56116	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.972399950 CET	56120	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.972563028 CET	3778	56118	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.977232933 CET	3778	56120	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.977304935 CET	56120	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.978404045 CET	56120	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.983227015 CET	3778	56120	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:43.983292103 CET	56120	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:43.988120079 CET	3778	56120	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.739466906 CET	3778	56118	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.739610910 CET	56118	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.739692926 CET	56118	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.740381002 CET	56122	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.745250940 CET	3778	56122	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.745352983 CET	56122	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.746680021 CET	56122	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.751426935 CET	3778	56122	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.751499891 CET	56122	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.756355047 CET	3778	56122	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.968643904 CET	3778	56120	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.968935966 CET	56120	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.968935966 CET	56120	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.969602108 CET	56124	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.976450920 CET	3778	56124	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.976511002 CET	56124	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.977572918 CET	56124	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.984558105 CET	3778	56124	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:44.984611034 CET	56124	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:44.991636992 CET	3778	56124	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:45.744729042 CET	3778	56122	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:45.744998932 CET	56122	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:45.745203018 CET	56122	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:45.746144056 CET	56126	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:45.750930071 CET	3778	56126	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:45.751034021 CET	56126	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:45.752363920 CET	56126	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:45.757186890 CET	3778	56126	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:45.757251978 CET	56126	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:45.762007952 CET	3778	56126	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.007415056 CET	3778	56124	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.007678986 CET	56124	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.007678986 CET	56124	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.008949041 CET	56128	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.013780117 CET	3778	56128	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.013920069 CET	56128	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.015531063 CET	56128	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.020317078 CET	3778	56128	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.020389080 CET	56128	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.025177002 CET	3778	56128	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.765145063 CET	3778	56126	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.765331984 CET	56126	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.765475035 CET	56126	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.766702890 CET	56130	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.771591902 CET	3778	56130	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.771673918 CET	56130	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.773324966 CET	56130	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.778140068 CET	3778	56130	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:46.778202057 CET	56130	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:46.784054995 CET	3778	56130	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.036364079 CET	3778	56128	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.036521912 CET	56128	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.036560059 CET	56128	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.037326097 CET	56132	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.042150021 CET	3778	56132	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.042243004 CET	56132	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.043273926 CET	56132	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.048926115 CET	3778	56132	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.048981905 CET	56132	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.054483891 CET	3778	56132	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.869390965 CET	3778	56130	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.869539976 CET	56130	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.869649887 CET	56130	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.870620966 CET	56134	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.875482082 CET	3778	56134	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.875561953 CET	56134	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.876832008 CET	56134	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.881688118 CET	3778	56134	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:47.881756067 CET	56134	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:47.886533022 CET	3778	56134	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.009891033 CET	3778	56132	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.009990931 CET	56132	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.010088921 CET	56132	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.011179924 CET	56136	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.016047955 CET	3778	56136	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.016104937 CET	56136	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.017342091 CET	56136	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.022146940 CET	3778	56136	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.022222042 CET	56136	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.026992083 CET	3778	56136	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.861915112 CET	3778	56134	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.862111092 CET	56134	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.862205029 CET	56134	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.863322020 CET	56138	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.868124962 CET	3778	56138	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.868216038 CET	56138	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.869198084 CET	56138	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.873966932 CET	3778	56138	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.874011993 CET	56138	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.878756046 CET	3778	56138	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.989912987 CET	3778	56136	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.990035057 CET	56136	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.990102053 CET	56136	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.990824938 CET	56140	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.995815992 CET	3778	56140	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:48.995889902 CET	56140	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:48.997129917 CET	56140	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.001940012 CET	3778	56140	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:49.002093077 CET	56140	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.006995916 CET	3778	56140	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:49.901824951 CET	3778	56138	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:49.901952982 CET	56138	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.901992083 CET	56138	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.902858019 CET	56142	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.907655001 CET	3778	56142	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:49.907740116 CET	56142	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.908889055 CET	56142	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.913649082 CET	3778	56142	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:49.913702011 CET	56142	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:49.918452978 CET	3778	56142	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.021615028 CET	3778	56140	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.021676064 CET	56140	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.021703959 CET	56140	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.022231102 CET	56144	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.027108908 CET	3778	56144	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.027173996 CET	56144	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.028151035 CET	56144	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.033039093 CET	3778	56144	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.033094883 CET	56144	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.037884951 CET	3778	56144	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.933800936 CET	3778	56142	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.934057951 CET	56142	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.934057951 CET	56142	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.934739113 CET	56146	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.939584970 CET	3778	56146	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.939651012 CET	56146	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.940515995 CET	56146	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.945296049 CET	3778	56146	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.945343971 CET	56146	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.950158119 CET	3778	56146	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.995543957 CET	3778	56144	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:50.995630980 CET	56144	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.995711088 CET	56144	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:50.996397972 CET	56148	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:51.001266956 CET	3778	56148	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:51.001333952 CET	56148	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:51.002458096 CET	56148	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:51.007278919 CET	3778	56148	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:51.007342100 CET	56148	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:51.012267113 CET	3778	56148	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.002444983 CET	3778	56146	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.002732992 CET	56146	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.002733946 CET	56146	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.003652096 CET	56150	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.008579969 CET	3778	56150	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.008658886 CET	56150	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.010097027 CET	56150	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.015068054 CET	3778	56150	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.015170097 CET	56150	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.019978046 CET	3778	56150	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.111438990 CET	3778	56148	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.111536980 CET	56148	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.111597061 CET	56148	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.112325907 CET	56152	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.117212057 CET	3778	56152	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.117291927 CET	56152	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.118654013 CET	56152	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.123539925 CET	3778	56152	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:52.123606920 CET	56152	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:52.128514051 CET	3778	56152	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.116698980 CET	3778	56150	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.116826057 CET	56150	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.116894007 CET	56150	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.117469072 CET	56154	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.122358084 CET	3778	56154	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.122442961 CET	56154	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.123393059 CET	56154	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.128210068 CET	3778	56154	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.128254890 CET	56154	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.133054018 CET	3778	56154	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.226218939 CET	3778	56152	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.226562977 CET	56152	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.226562977 CET	56152	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.227277040 CET	56156	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.232238054 CET	3778	56156	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.232316017 CET	56156	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.233333111 CET	56156	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.238584042 CET	3778	56156	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:53.238650084 CET	56156	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:53.243483067 CET	3778	56156	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.222920895 CET	3778	56154	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.223212957 CET	56154	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.223237991 CET	56154	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.223941088 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.228852034 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.228944063 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.229824066 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.234709024 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.234781027 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.239613056 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.311213017 CET	3778	56156	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.311441898 CET	56156	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.311441898 CET	56156	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.312321901 CET	56160	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.317164898 CET	3778	56160	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.317282915 CET	56160	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.318444967 CET	56160	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.323260069 CET	3778	56160	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:54.323352098 CET	56160	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:54.328180075 CET	3778	56160	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:55.424750090 CET	3778	56160	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:55.424971104 CET	56160	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:55.424999952 CET	56160	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:55.425906897 CET	56162	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:55.430764914 CET	3778	56162	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:55.430823088 CET	56162	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:55.432128906 CET	56162	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:55.437062979 CET	3778	56162	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:55.437109947 CET	56162	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:55.441952944 CET	3778	56162	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:56.397053003 CET	3778	56162	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:56.397265911 CET	56162	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:56.397397041 CET	56162	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:56.398441076 CET	56164	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:56.403388023 CET	3778	56164	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:56.403532982 CET	56164	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:56.404839993 CET	56164	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:56.409652948 CET	3778	56164	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:56.409738064 CET	56164	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:56.414585114 CET	3778	56164	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:57.378846884 CET	3778	56164	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:57.378989935 CET	56164	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:57.379082918 CET	56164	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:57.379811049 CET	56166	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:57.384677887 CET	3778	56166	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:57.384757996 CET	56166	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:57.385777950 CET	56166	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:57.390621901 CET	3778	56166	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:57.390691042 CET	56166	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:57.395490885 CET	3778	56166	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:58.357115030 CET	3778	56166	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:58.357270002 CET	56166	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:58.357383013 CET	56166	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:58.358200073 CET	56168	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:58.363193035 CET	3778	56168	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:58.363270044 CET	56168	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:58.364479065 CET	56168	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:58.369292974 CET	3778	56168	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:58.369344950 CET	56168	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:58.374154091 CET	3778	56168	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:59.374139071 CET	3778	56168	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:59.374591112 CET	56168	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:59.374591112 CET	56168	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:59.375638008 CET	56170	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:59.380570889 CET	3778	56170	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:59.380656958 CET	56170	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:59.382097006 CET	56170	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:59.386894941 CET	3778	56170	61.7.209.115	192.168.2.13
Feb 17, 2025 17:23:59.386959076 CET	56170	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:23:59.392493010 CET	3778	56170	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:00.472944975 CET	3778	56170	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:00.473190069 CET	56170	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:00.473354101 CET	56170	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:00.474235058 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:00.479074955 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:00.479149103 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:00.480266094 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:00.485292912 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:00.485356092 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:00.490149975 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:04.239037991 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:04.245105028 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:04.597381115 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:04.597645044 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:10.490936041 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:10.702832937 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:24:10.848261118 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:10.848294020 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:11.252268076 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:24:11.252599001 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:25:04.654005051 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:25:04.659534931 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:25:05.012126923 CET	3778	56158	61.7.209.115	192.168.2.13
Feb 17, 2025 17:25:05.012451887 CET	56158	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:25:11.305375099 CET	56172	3778	192.168.2.13	61.7.209.115
Feb 17, 2025 17:25:11.310473919 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:25:11.666526079 CET	3778	56172	61.7.209.115	192.168.2.13
Feb 17, 2025 17:25:11.666696072 CET	56172	3778	192.168.2.13	61.7.209.115

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434, Parent PID: 5359

General

Start time (UTC):	16:23:19
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438, Parent PID: 5434

General

Start time (UTC):	16:23:19
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, Parent PID: 5438

General

Start time (UTC):	16:23:19
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5442, Parent PID: 5438

General

Start time (UTC):	16:23:19
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5456, Parent PID: 5434

General

Start time (UTC):	16:23:25
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5458, Parent PID: 5434

General

Start time (UTC):	16:23:25
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5434, Parent PID: 5359

General

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5438, Parent PID: 5434

General

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm.elf PID: 5440, Parent PID: 5438

General

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm.elf