Edit tour

Linux Analysis Report
boatnet.spc.elf

Overview

General Information

Sample name:	boatnet.spc.elf
Analysis ID:	1617595
MD5:	617b5ca8e565db53d7300192400dc76f
SHA1:	eda563a18ade648a57399552b9a93ee34fe5aa68
SHA256:	fd359bb4e2dd8f443410fe2ba03c920d3c29289933dc603125e3fa8223317b50
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617595
Start date and time:	2025-02-18 03:17:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	boatnet.spc.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/boatnet.spc.elf
PID:	5569
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

boatnet.spc.elf (PID: 5569, Parent: 5367, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/boatnet.spc.elf

boatnet.spc.elf New Fork (PID: 5571, Parent: 5569)

boatnet.spc.elf New Fork (PID: 5572, Parent: 5569)

boatnet.spc.elf New Fork (PID: 5573, Parent: 5569)

xfce4-panel New Fork (PID: 5579, Parent: 3147)

wrapper-2.0 (PID: 5579, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5580, Parent: 3147)

wrapper-2.0 (PID: 5580, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5581, Parent: 3147)

wrapper-2.0 (PID: 5581, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5582, Parent: 3147)

wrapper-2.0 (PID: 5582, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5583, Parent: 3147)

wrapper-2.0 (PID: 5583, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5584, Parent: 3147)

wrapper-2.0 (PID: 5584, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
boatnet.spc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
boatnet.spc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
boatnet.spc.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5572.1.00007f4554011000.00007f455401f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5572.1.00007f4554011000.00007f455401f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5572.1.00007f4554011000.00007f455401f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5569.1.00007f4554011000.00007f455401f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5569.1.00007f4554011000.00007f455401f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5569.1.00007f4554011000.00007f455401f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.spc.elf PID: 5569	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.spc.elf PID: 5569	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x455:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x469:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x491:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x509:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x531:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x545:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x559:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x581:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x595:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.spc.elf PID: 5569	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x913:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.spc.elf PID: 5572	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5a45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5aa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5abd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ad1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ae5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5af9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.spc.elf PID: 5572	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5f03:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 6 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: boatnet.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: boatnet.spc.elf

Virustotal: Detection: 65%

Perma Link

Source: global traffic

TCP traffic: 192.168.2.13:33428 -> 193.32.162.38:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38
Source: unknown	TCP traffic detected without corresponding DNS query: 193.32.162.38

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: boatnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: boatnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5572.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5572.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5569.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5569.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.spc.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.spc.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.spc.elf PID: 5572, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.spc.elf PID: 5572, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5579, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5580, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5581, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5583, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5584, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5579, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5580, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5581, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5583, result: successful	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	SIGKILL sent: pid: 5584, result: successful	Jump to behavior

Source: boatnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: boatnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5572.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5572.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5569.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5569.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.spc.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.spc.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.spc.elf PID: 5572, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.spc.elf PID: 5572, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/0@2/0

Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/518/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3637/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5391/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5424/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5548/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5549/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5287/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5573/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5050/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3705/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3706/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3707/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3708/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1805/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1925/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1804/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1922/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3429/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5580/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5581/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5582/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3442/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3165/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3164/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3163/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3162/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/790/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3161/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/792/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/672/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1930/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/3315/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1411/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/2984/cmdline	Jump to behavior
Source: /tmp/boatnet.spc.elf (PID: 5571)	File opened: /proc/1410/cmdline	Jump to behavior

Source: /tmp/boatnet.spc.elf (PID: 5569)

Queries kernel information via 'uname':

Jump to behavior

Source: boatnet.spc.elf, 5569.1.000055a7b6db0000.000055a7b6e35000.rw-.sdmp, boatnet.spc.elf, 5572.1.000055a7b6db0000.000055a7b6e35000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: boatnet.spc.elf, 5569.1.000055a7b6db0000.000055a7b6e35000.rw-.sdmp, boatnet.spc.elf, 5572.1.000055a7b6db0000.000055a7b6e35000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: boatnet.spc.elf, 5569.1.00007ffe26ed7000.00007ffe26ef8000.rw-.sdmp, boatnet.spc.elf, 5572.1.00007ffe26ed7000.00007ffe26ef8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/boatnet.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.spc.elf
Source: boatnet.spc.elf, 5569.1.00007ffe26ed7000.00007ffe26ef8000.rw-.sdmp, boatnet.spc.elf, 5572.1.00007ffe26ed7000.00007ffe26ef8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: boatnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5572.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5569.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.spc.elf PID: 5569, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: boatnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5572.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5569.1.00007f4554011000.00007f455401f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.spc.elf PID: 5569, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
boatnet.spc.elf	65%	Virustotal		Browse
boatnet.spc.elf	100%	Avira	EXP/ELF.Gafgyt.D

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.32.162.38	unknown	Romania		35478	DATACENTERRO	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.32.162.38	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	cron.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	sh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	pftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	tftp.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACENTERRO	193.32.162.38-boatnet.arm7-2025-02-18T00_55_21.elf	Get hash	malicious	Mirai	Browse	193.32.162.38
	dd.elf	Get hash	malicious	Unknown	Browse	2.57.122.74
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	194.85.251.38
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	194.85.251.38
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.066380817304289
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	boatnet.spc.elf
File size:	58'376 bytes
MD5:	617b5ca8e565db53d7300192400dc76f
SHA1:	eda563a18ade648a57399552b9a93ee34fe5aa68
SHA256:	fd359bb4e2dd8f443410fe2ba03c920d3c29289933dc603125e3fa8223317b50
SHA512:	45b12911dab8461111f81ff91727b18de771dc1ad97af1393769c4e1f405fea157c01feaac3017b436ce5f812a9a7982717469dec8249216f2da67585468f270
SSDEEP:	768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwW:RqtmZPuutfbltZFBSJsBcfDSTFI+BEW
TLSH:	EA432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8
File Content Preview:	.ELF...........................4...x.....4. ...(.......................................................8...P........dt.Q................................@..(....@.2.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	57976
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xc888	0x0	0x6	AX	4
.fini	PROGBITS	0x1c938	0xc938	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1c950	0xc950	0x11b0	0x0	0x2	A	8
.ctors	PROGBITS	0x2e000	0xe000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e008	0xe008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2e018	0xe018	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x2e238	0xe238	0x318	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xe238	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xdb00	0xdb00	6.1729	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xe000	0x2e000	0x2e000	0x238	0x550	2.9229	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 246
• 3778 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 03:18:16.600720882 CET	33428	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:16.605585098 CET	3778	33428	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:16.605654955 CET	33428	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:16.626059055 CET	33428	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:16.631333113 CET	3778	33428	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:16.631381989 CET	33428	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:16.636167049 CET	3778	33428	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.289112091 CET	3778	33428	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.289294004 CET	33428	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.289510012 CET	33428	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.292057037 CET	33430	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.302073002 CET	3778	33430	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.302138090 CET	33430	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.307291031 CET	33430	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.312326908 CET	3778	33430	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.312387943 CET	33430	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.317312956 CET	3778	33430	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.957192898 CET	3778	33430	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.957551003 CET	33430	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.957551003 CET	33430	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.958909988 CET	33432	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.963733912 CET	3778	33432	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.963788986 CET	33432	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.965615034 CET	33432	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.970376968 CET	3778	33432	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:17.970423937 CET	33432	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:17.975243092 CET	3778	33432	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:18.657040119 CET	3778	33432	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:18.658474922 CET	33432	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:18.658499956 CET	33432	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:18.698421001 CET	33434	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:18.705698967 CET	3778	33434	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:18.705893993 CET	33434	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:18.753179073 CET	33434	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:18.758177042 CET	3778	33434	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:18.758232117 CET	33434	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:18.763395071 CET	3778	33434	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:19.373003006 CET	3778	33434	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:19.373125076 CET	33434	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:19.373209000 CET	33434	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:19.374618053 CET	33436	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:19.381356001 CET	3778	33436	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:19.381422997 CET	33436	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:19.385546923 CET	33436	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:19.392026901 CET	3778	33436	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:19.392077923 CET	33436	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:19.399358034 CET	3778	33436	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.042540073 CET	3778	33436	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.042601109 CET	33436	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.042731047 CET	33436	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.043566942 CET	33438	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.048422098 CET	3778	33438	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.048480988 CET	33438	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.050492048 CET	33438	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.055335999 CET	3778	33438	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.055377007 CET	33438	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.060147047 CET	3778	33438	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.737277031 CET	3778	33438	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.737384081 CET	33438	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.737479925 CET	33438	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.738481045 CET	33440	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.743294954 CET	3778	33440	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.743360043 CET	33440	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.746699095 CET	33440	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.751429081 CET	3778	33440	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:20.751562119 CET	33440	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:20.756325006 CET	3778	33440	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:21.421267033 CET	3778	33440	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:21.421351910 CET	33440	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:21.421436071 CET	33440	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:21.422615051 CET	33442	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:21.427407026 CET	3778	33442	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:21.427463055 CET	33442	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:21.430648088 CET	33442	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:21.435420036 CET	3778	33442	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:21.435467005 CET	33442	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:21.440257072 CET	3778	33442	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.134005070 CET	3778	33442	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.134351969 CET	33442	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.134443045 CET	33442	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.135715008 CET	33444	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.140574932 CET	3778	33444	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.140639067 CET	33444	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.143287897 CET	33444	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.148055077 CET	3778	33444	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.148104906 CET	33444	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.152975082 CET	3778	33444	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.840704918 CET	3778	33444	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.840816975 CET	33444	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.840816975 CET	33444	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.841808081 CET	33446	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.850914955 CET	3778	33446	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.850971937 CET	33446	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.853853941 CET	33446	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.860738993 CET	3778	33446	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:22.860989094 CET	33446	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:22.866072893 CET	3778	33446	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:23.506392002 CET	3778	33446	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:23.506571054 CET	33446	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:23.506609917 CET	33446	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:23.507308006 CET	33448	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:23.512155056 CET	3778	33448	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:23.512371063 CET	33448	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:23.514120102 CET	33448	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:23.518902063 CET	3778	33448	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:23.519023895 CET	33448	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:23.523749113 CET	3778	33448	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.201411009 CET	3778	33448	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.204200983 CET	33448	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.204312086 CET	33448	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.212201118 CET	33450	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.217000008 CET	3778	33450	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.217128992 CET	33450	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.217961073 CET	33450	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.222760916 CET	3778	33450	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.222832918 CET	33450	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.227678061 CET	3778	33450	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.893080950 CET	3778	33450	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.893235922 CET	33450	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.893235922 CET	33450	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.893698931 CET	33452	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.898508072 CET	3778	33452	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.898557901 CET	33452	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.899178982 CET	33452	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.903919935 CET	3778	33452	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:24.903963089 CET	33452	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:24.912131071 CET	3778	33452	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:25.584340096 CET	3778	33452	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:25.584397078 CET	33452	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:25.584458113 CET	33452	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:25.584877968 CET	33454	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:25.589641094 CET	3778	33454	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:25.589700937 CET	33454	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:25.590374947 CET	33454	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:25.595182896 CET	3778	33454	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:25.595232964 CET	33454	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:25.600016117 CET	3778	33454	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.263448000 CET	3778	33454	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.263628006 CET	33454	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.263696909 CET	33454	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.264472008 CET	33456	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.269367933 CET	3778	33456	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.269453049 CET	33456	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.270315886 CET	33456	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.275095940 CET	3778	33456	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.275150061 CET	33456	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.279937983 CET	3778	33456	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.944066048 CET	3778	33456	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.944200039 CET	33456	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.944238901 CET	33456	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.944850922 CET	33458	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.949668884 CET	3778	33458	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.949718952 CET	33458	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.950683117 CET	33458	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.955554962 CET	3778	33458	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:26.955595970 CET	33458	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:26.960386992 CET	3778	33458	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:27.632003069 CET	3778	33458	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:27.632086992 CET	33458	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:27.632127047 CET	33458	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:27.632694960 CET	33460	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:27.637515068 CET	3778	33460	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:27.637583971 CET	33460	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:27.638314009 CET	33460	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:27.643167019 CET	3778	33460	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:27.643213987 CET	33460	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:27.648052931 CET	3778	33460	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:28.311463118 CET	3778	33460	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:28.311584949 CET	33460	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.311666965 CET	33460	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.312541008 CET	33462	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.317375898 CET	3778	33462	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:28.317430019 CET	33462	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.318578005 CET	33462	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.323374033 CET	3778	33462	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:28.323412895 CET	33462	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.328159094 CET	3778	33462	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:28.998030901 CET	3778	33462	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:28.998155117 CET	33462	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.998244047 CET	33462	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:28.999432087 CET	33464	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.004257917 CET	3778	33464	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:29.004349947 CET	33464	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.005831957 CET	33464	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.010672092 CET	3778	33464	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:29.011140108 CET	33464	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.015870094 CET	3778	33464	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:29.660831928 CET	3778	33464	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:29.660928965 CET	33464	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.661048889 CET	33464	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.661725998 CET	33466	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.666569948 CET	3778	33466	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:29.666702986 CET	33466	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.667484045 CET	33466	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.672276974 CET	3778	33466	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:29.672341108 CET	33466	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:29.677237034 CET	3778	33466	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:30.350552082 CET	3778	33466	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:30.350724936 CET	33466	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:30.350786924 CET	33466	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:30.351392984 CET	33468	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:30.356194019 CET	3778	33468	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:30.356245041 CET	33468	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:30.357065916 CET	33468	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:30.361809969 CET	3778	33468	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:30.361855030 CET	33468	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:30.366595984 CET	3778	33468	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.022012949 CET	3778	33468	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.022124052 CET	33468	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.022209883 CET	33468	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.022953987 CET	33470	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.027753115 CET	3778	33470	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.027832031 CET	33470	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.028727055 CET	33470	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.033565998 CET	3778	33470	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.033626080 CET	33470	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.038494110 CET	3778	33470	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.707003117 CET	3778	33470	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.707228899 CET	33470	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.707257986 CET	33470	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.707834959 CET	33472	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.712701082 CET	3778	33472	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.712753057 CET	33472	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.713515997 CET	33472	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.718338966 CET	3778	33472	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:31.718401909 CET	33472	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:31.723758936 CET	3778	33472	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:32.381201029 CET	3778	33472	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:32.381337881 CET	33472	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:32.381339073 CET	33472	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:32.382123947 CET	33474	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:32.386987925 CET	3778	33474	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:32.387039900 CET	33474	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:32.387654066 CET	33474	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:32.392427921 CET	3778	33474	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:32.392474890 CET	33474	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:32.397300959 CET	3778	33474	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.080497980 CET	3778	33474	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.080740929 CET	33474	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.080740929 CET	33474	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.081470966 CET	33476	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.086445093 CET	3778	33476	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.086508036 CET	33476	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.087492943 CET	33476	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.092308998 CET	3778	33476	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.092364073 CET	33476	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.097161055 CET	3778	33476	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.744676113 CET	3778	33476	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.744921923 CET	33476	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.744921923 CET	33476	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.745592117 CET	33478	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.750432968 CET	3778	33478	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.750485897 CET	33478	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.751214981 CET	33478	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.756027937 CET	3778	33478	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:33.756072998 CET	33478	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:33.760876894 CET	3778	33478	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:34.433887959 CET	3778	33478	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:34.434020996 CET	33478	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:34.434115887 CET	33478	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:34.434767962 CET	33480	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:34.439560890 CET	3778	33480	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:34.439624071 CET	33480	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:34.440428972 CET	33480	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:34.445185900 CET	3778	33480	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:34.445233107 CET	33480	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:34.450025082 CET	3778	33480	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.128016949 CET	3778	33480	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.128151894 CET	33480	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.128242970 CET	33480	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.128931046 CET	33482	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.133796930 CET	3778	33482	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.133883953 CET	33482	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.134654999 CET	33482	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.139458895 CET	3778	33482	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.139528990 CET	33482	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.144341946 CET	3778	33482	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.835738897 CET	3778	33482	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.835850000 CET	33482	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.836016893 CET	33482	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.836731911 CET	33484	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.841685057 CET	3778	33484	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.841875076 CET	33484	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.842720985 CET	33484	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.847697020 CET	3778	33484	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:35.847738981 CET	33484	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:35.852587938 CET	3778	33484	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:36.518675089 CET	3778	33484	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:36.518841028 CET	33484	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:36.518841982 CET	33484	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:36.519402027 CET	33486	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:36.524290085 CET	3778	33486	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:36.524375916 CET	33486	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:36.525283098 CET	33486	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:36.530015945 CET	3778	33486	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:36.530105114 CET	33486	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:36.535231113 CET	3778	33486	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.213690042 CET	3778	33486	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.213890076 CET	33486	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.213974953 CET	33486	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.214948893 CET	33488	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.219861031 CET	3778	33488	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.219934940 CET	33488	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.221174002 CET	33488	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.226226091 CET	3778	33488	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.226375103 CET	33488	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.231251955 CET	3778	33488	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.876935005 CET	3778	33488	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.877069950 CET	33488	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.877114058 CET	33488	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.878038883 CET	33490	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.882937908 CET	3778	33490	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.882989883 CET	33490	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.884032965 CET	33490	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.888942003 CET	3778	33490	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:37.888984919 CET	33490	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:37.893790007 CET	3778	33490	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:38.550189972 CET	3778	33490	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:38.550319910 CET	33490	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:38.550321102 CET	33490	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:38.551042080 CET	33492	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:38.558510065 CET	3778	33492	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:38.558577061 CET	33492	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:38.559585094 CET	33492	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:38.567219973 CET	3778	33492	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:38.567276955 CET	33492	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:38.575817108 CET	3778	33492	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.234654903 CET	3778	33492	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.234811068 CET	33492	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.234811068 CET	33492	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.235595942 CET	33494	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.241475105 CET	3778	33494	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.241538048 CET	33494	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.242506027 CET	33494	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.247371912 CET	3778	33494	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.247425079 CET	33494	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.253375053 CET	3778	33494	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.905411005 CET	3778	33494	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.905524015 CET	33494	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.905582905 CET	33494	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.906275988 CET	33496	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.911231995 CET	3778	33496	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.911305904 CET	33496	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.912009001 CET	33496	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.916832924 CET	3778	33496	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:39.916879892 CET	33496	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:39.921700954 CET	3778	33496	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:40.585542917 CET	3778	33496	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:40.585726976 CET	33496	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:40.585726976 CET	33496	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:40.586366892 CET	33498	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:40.591289043 CET	3778	33498	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:40.591387987 CET	33498	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:40.592511892 CET	33498	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:40.597382069 CET	3778	33498	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:40.597457886 CET	33498	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:40.602363110 CET	3778	33498	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.266314983 CET	3778	33498	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.266678095 CET	33498	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.266678095 CET	33498	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.267461061 CET	33500	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.272615910 CET	3778	33500	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.272684097 CET	33500	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.273799896 CET	33500	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.278781891 CET	3778	33500	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.278842926 CET	33500	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.283838987 CET	3778	33500	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.937609911 CET	3778	33500	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.937825918 CET	33500	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.937825918 CET	33500	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.938724041 CET	33502	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.943646908 CET	3778	33502	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.943705082 CET	33502	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.944726944 CET	33502	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.949498892 CET	3778	33502	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:41.949544907 CET	33502	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:41.954425097 CET	3778	33502	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:42.615161896 CET	3778	33502	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:42.615278959 CET	33502	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:42.615305901 CET	33502	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:42.616096973 CET	33504	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:42.620909929 CET	3778	33504	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:42.620964050 CET	33504	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:42.621891975 CET	33504	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:42.626847982 CET	3778	33504	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:42.626895905 CET	33504	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:42.631668091 CET	3778	33504	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:43.290221930 CET	3778	33504	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:43.290380955 CET	33504	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:43.290381908 CET	33504	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:43.291168928 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:43.296061039 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:43.296117067 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:43.297060013 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:43.301865101 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:43.301918983 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:43.306782961 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:53.304908991 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:18:53.310038090 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:53.517328978 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:18:53.518007040 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:19:53.564829111 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:19:53.573141098 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:19:53.775630951 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:19:53.775872946 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:20:53.824780941 CET	33506	3778	192.168.2.13	193.32.162.38
Feb 18, 2025 03:20:53.830203056 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:20:54.035680056 CET	3778	33506	193.32.162.38	192.168.2.13
Feb 18, 2025 03:20:54.035860062 CET	33506	3778	192.168.2.13	193.32.162.38

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 03:21:00.351715088 CET	33259	53	192.168.2.13	8.8.8.8
Feb 18, 2025 03:21:00.351773024 CET	55911	53	192.168.2.13	8.8.8.8
Feb 18, 2025 03:21:00.358114958 CET	53	55911	8.8.8.8	192.168.2.13
Feb 18, 2025 03:21:00.358436108 CET	53	33259	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 18, 2025 03:21:00.351715088 CET	192.168.2.13	8.8.8.8	0xef4b	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Feb 18, 2025 03:21:00.351773024 CET	192.168.2.13	8.8.8.8	0x4924	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 18, 2025 03:21:00.358436108 CET	8.8.8.8	192.168.2.13	0xef4b	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Feb 18, 2025 03:21:00.358436108 CET	8.8.8.8	192.168.2.13	0xef4b	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: boatnet.spc.elf PID: 5569, Parent PID: 5367

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/tmp/boatnet.spc.elf
Arguments:	/tmp/boatnet.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: boatnet.spc.elf PID: 5571, Parent PID: 5569

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/tmp/boatnet.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: boatnet.spc.elf PID: 5572, Parent PID: 5569

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/tmp/boatnet.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

File Activities

File Opened

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: boatnet.spc.elf PID: 5573, Parent PID: 5569

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/tmp/boatnet.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 5579, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5579, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-panel PID: 5580, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5580, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-panel PID: 5581, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5581, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-panel PID: 5582, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5582, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-panel PID: 5583, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5583, Parent PID: 3147

General

Start time (UTC):	02:18:15
Start date (UTC):	18/02/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-panel PID: 5584, Parent PID: 3147

General

Start time (UTC):	02:18:16
Start date (UTC):	18/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5584, Parent PID: 3147

General

Start time (UTC):	02:18:16
Start date (UTC):	18/02/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report boatnet.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: boatnet.spc.elf PID: 5569, Parent PID: 5367

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: boatnet.spc.elf PID: 5571, Parent PID: 5569

General

File Activities

File Opened

Linux Analysis Report
boatnet.spc.elf