Edit tour

Linux Analysis Report
boatnet.spc.elf

Overview

General Information

Sample name:boatnet.spc.elf
Analysis ID:1634178
MD5:17866fa434d547fac240ddc84fd302b0
SHA1:8790f0cc8d9b94c7ad45a691223ee57dbc908726
SHA256:5d6e53c52fec6e0fab62a45be7172d5177c795ca7264c179adfe8515c94a37dd
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score:76
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample tries to kill multiple processes (SIGKILL)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1634178
Start date and time:2025-03-10 20:32:11 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 8s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.spc.elf
Detection:MAL
Classification:mal76.spre.troj.linELF@0/0@2/0
Command:/tmp/boatnet.spc.elf
PID:5442
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5453, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5454, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5455, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5456, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
  • wrapper-2.0 (PID: 5457, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5458, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
boatnet.spc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    boatnet.spc.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    boatnet.spc.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        Click to see the 7 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: boatnet.spc.elfAvira: detected
        Source: boatnet.spc.elfVirustotal: Detection: 61%Perma Link
        Source: boatnet.spc.elfReversingLabs: Detection: 65%
        Source: global trafficTCP traffic: 192.168.2.13:58050 -> 87.121.84.183:3778
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

        System Summary

        barindex
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5446, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5446, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3104, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3161, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3162, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3164, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5453, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5454, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5455, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5456, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5457, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5458, result: successfulJump to behavior
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3104, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3161, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3162, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3164, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5453, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5454, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5455, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5456, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5457, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)SIGKILL sent: pid: 5458, result: successfulJump to behavior
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5446, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5446, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal76.spre.troj.linELF@0/0@2/0
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3122/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3117/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3114/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/518/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3634/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/519/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3770/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3134/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3375/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3132/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5390/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3095/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1745/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1866/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/884/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1982/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/765/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3246/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/767/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1906/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5426/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1748/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5428/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5285/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1755/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1875/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/2964/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3938/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3413/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1751/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1872/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/2961/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/656/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/778/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/657/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/658/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/659/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/418/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/419/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/816/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1879/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5453/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5454/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5455/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1891/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3310/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3153/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/780/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/660/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1921/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3704/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3705/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/783/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1765/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3706/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/2974/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1400/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1884/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3424/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/2972/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3147/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/2970/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1881/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3146/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3300/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1805/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/5448/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1925/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1804/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1648/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1922/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3429/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3703/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3442/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3165/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3164/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3163/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3162/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/790/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3161/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/792/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/793/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/672/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1930/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/674/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/795/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/3315/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1411/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/2984/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/1410/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/797/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5445)File opened: /proc/676/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5442)Queries kernel information via 'uname': Jump to behavior
        Source: boatnet.spc.elf, 5442.1.000056376a242000.000056376a2c7000.rw-.sdmp, boatnet.spc.elf, 5446.1.000056376a242000.000056376a2c7000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
        Source: boatnet.spc.elf, 5442.1.000056376a242000.000056376a2c7000.rw-.sdmp, boatnet.spc.elf, 5446.1.000056376a242000.000056376a2c7000.rw-.sdmpBinary or memory string: <$j7V!/etc/qemu-binfmt/sparc
        Source: boatnet.spc.elf, 5442.1.00007ffd48bbc000.00007ffd48bdd000.rw-.sdmp, boatnet.spc.elf, 5446.1.00007ffd48bbc000.00007ffd48bdd000.rw-.sdmpBinary or memory string: mx86_64/usr/bin/qemu-sparc/tmp/boatnet.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.spc.elf
        Source: boatnet.spc.elf, 5442.1.00007ffd48bbc000.00007ffd48bdd000.rw-.sdmp, boatnet.spc.elf, 5446.1.00007ffd48bbc000.00007ffd48bdd000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: boatnet.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.spc.elf PID: 5442, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.spc.elf PID: 5446, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: boatnet.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 5442.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5446.1.00007f4b1c011000.00007f4b1c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.spc.elf PID: 5442, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.spc.elf PID: 5446, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Non-Standard Port
        Exfiltration Over Other Network Medium1
        Service Stop
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1634178 Sample: boatnet.spc.elf Startdate: 10/03/2025 Architecture: LINUX Score: 76 22 87.121.84.183, 3778, 58050, 58052 SKATTV-ASBG Bulgaria 2->22 24 daisy.ubuntu.com 2->24 26 Malicious sample detected (through community Yara rule) 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 7 boatnet.spc.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 4 other processes 2->13 signatures3 process4 process5 15 boatnet.spc.elf 7->15         started        18 boatnet.spc.elf 7->18         started        20 boatnet.spc.elf 7->20         started        signatures6 34 Sample tries to kill multiple processes (SIGKILL) 15->34

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        boatnet.spc.elf62%VirustotalBrowse
        boatnet.spc.elf66%ReversingLabsLinux.Backdoor.Mirai
        boatnet.spc.elf100%AviraEXP/ELF.Gafgyt.D
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.24
        truefalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          87.121.84.183
          unknownBulgaria
          34577SKATTV-ASBGfalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          87.121.84.183boatnet.m68k.elfGet hashmaliciousMiraiBrowse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            daisy.ubuntu.com.i.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            sshd.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.25
            mpsl.elfGet hashmaliciousMirai, MoobotBrowse
            • 162.213.35.24
            arm5.elfGet hashmaliciousMiraiBrowse
            • 162.213.35.25
            arm6.elfGet hashmaliciousMirai, MoobotBrowse
            • 162.213.35.24
            mips.elfGet hashmaliciousMirai, MoobotBrowse
            • 162.213.35.24
            x86.elfGet hashmaliciousMirai, MoobotBrowse
            • 162.213.35.24
            gif.elfGet hashmaliciousXmrigBrowse
            • 162.213.35.24
            gif.elfGet hashmaliciousXmrigBrowse
            • 162.213.35.25
            nklarm6.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            SKATTV-ASBGboatnet.m68k.elfGet hashmaliciousMiraiBrowse
            • 87.121.84.183
            yakov.mips.elfGet hashmaliciousMiraiBrowse
            • 87.120.53.122
            tftp.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            apache2.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            sshd.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            ftp.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            wget.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            openssh.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            pftp.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            cron.elfGet hashmaliciousUnknownBrowse
            • 87.121.84.89
            No context
            No context
            No created / dropped files found
            File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
            Entropy (8bit):6.0663884269455615
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:boatnet.spc.elf
            File size:58'376 bytes
            MD5:17866fa434d547fac240ddc84fd302b0
            SHA1:8790f0cc8d9b94c7ad45a691223ee57dbc908726
            SHA256:5d6e53c52fec6e0fab62a45be7172d5177c795ca7264c179adfe8515c94a37dd
            SHA512:5c49e6bdb963db2bd0c8a402f82e4a6e64b10f5f91cb32cd59eda9b033eb35c30fc04daea29aca0fbdd881f0f14bd4e61829e27356405b7a3ec8789bbdb3d9c6
            SSDEEP:768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwr:RqtmZPuutfbltZFBSJsBcfDSTFI+BEr
            TLSH:9A432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8
            File Content Preview:.ELF...........................4...x.....4. ...(.......................................................8...P........dt.Q................................@..(....@.2.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

            ELF header

            Class:ELF32
            Data:2's complement, big endian
            Version:1 (current)
            Machine:Sparc
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x101a4
            Flags:0x0
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:57976
            Section Header Size:40
            Number of Section Headers:10
            Header String Table Index:9
            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x100940x940x1c0x00x6AX004
            .textPROGBITS0x100b00xb00xc8880x00x6AX004
            .finiPROGBITS0x1c9380xc9380x140x00x6AX004
            .rodataPROGBITS0x1c9500xc9500x11b00x00x2A008
            .ctorsPROGBITS0x2e0000xe0000x80x00x3WA004
            .dtorsPROGBITS0x2e0080xe0080x80x00x3WA004
            .dataPROGBITS0x2e0180xe0180x2200x00x3WA008
            .bssNOBITS0x2e2380xe2380x3180x00x3WA004
            .shstrtabSTRTAB0x00xe2380x3e0x00x0001
            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x100000x100000xdb000xdb006.17290x5R E0x10000.init .text .fini .rodata
            LOAD0xe0000x2e0000x2e0000x2380x5502.92290x6RW 0x10000.ctors .dtors .data .bss
            GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

            Download Network PCAP: filteredfull

            • Total Packets: 324
            • 3778 undefined
            • 53 (DNS)
            TimestampSource PortDest PortSource IPDest IP
            Mar 10, 2025 20:32:59.418230057 CET580503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:32:59.423438072 CET37785805087.121.84.183192.168.2.13
            Mar 10, 2025 20:32:59.423504114 CET580503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:32:59.438275099 CET580503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:32:59.444173098 CET37785805087.121.84.183192.168.2.13
            Mar 10, 2025 20:32:59.444264889 CET580503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:32:59.449105978 CET37785805087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.043781042 CET37785805087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.043839931 CET580503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.044080019 CET580503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.046154976 CET580523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.053026915 CET37785805287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.053107977 CET580523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.058557987 CET580523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.063411951 CET37785805287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.063461065 CET580523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.068273067 CET37785805287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.705874920 CET37785805287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.706052065 CET580523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.706052065 CET580523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.707144022 CET580543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.712069035 CET37785805487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.712179899 CET580543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.714509010 CET580543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.719352007 CET37785805487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:00.719408035 CET580543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:00.724211931 CET37785805487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:01.396056890 CET37785805487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:01.396286011 CET580543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:01.396286011 CET580543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:01.441699982 CET580563778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:01.446587086 CET37785805687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:01.446819067 CET580563778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:01.476694107 CET580563778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:01.481573105 CET37785805687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:01.481734991 CET580563778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:01.487241030 CET37785805687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.171852112 CET37785805687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.171967983 CET580563778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.171967983 CET580563778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.172828913 CET580583778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.177757025 CET37785805887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.177829981 CET580583778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.179970980 CET580583778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.184895992 CET37785805887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.184967995 CET580583778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.189805031 CET37785805887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.784406900 CET37785805887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.784506083 CET580583778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.784586906 CET580583778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.785449028 CET580603778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.790260077 CET37785806087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.790313959 CET580603778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.792453051 CET580603778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.797182083 CET37785806087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:02.797228098 CET580603778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:02.802154064 CET37785806087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:03.448395967 CET37785806087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:03.448467970 CET580603778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:03.448515892 CET580603778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:03.449774981 CET580623778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:03.454660892 CET37785806287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:03.454763889 CET580623778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:03.458492994 CET580623778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:03.463429928 CET37785806287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:03.463960886 CET580623778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:03.468743086 CET37785806287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.084141970 CET37785806287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.084237099 CET580623778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.084351063 CET580623778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.085555077 CET580643778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.090363026 CET37785806487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.090447903 CET580643778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.093020916 CET580643778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.098032951 CET37785806487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.098642111 CET580643778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.103496075 CET37785806487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.693130970 CET37785806487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.693219900 CET580643778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.693284988 CET580643778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.693763971 CET580663778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.699033022 CET37785806687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.699136019 CET580663778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.701262951 CET580663778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.706135035 CET37785806687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:04.706176043 CET580663778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:04.711024046 CET37785806687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.328907013 CET37785806687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.328983068 CET580663778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.329030991 CET580663778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.329752922 CET580683778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.334680080 CET37785806887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.334769011 CET580683778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.339262962 CET580683778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.344073057 CET37785806887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.344181061 CET580683778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.349867105 CET37785806887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.982094049 CET37785806887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.982213020 CET580683778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.982213020 CET580683778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.983439922 CET580703778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.988354921 CET37785807087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.988416910 CET580703778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.990997076 CET580703778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:05.995784044 CET37785807087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:05.995840073 CET580703778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.000567913 CET37785807087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:06.650685072 CET37785807087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:06.650845051 CET580703778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.650897026 CET580703778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.651477098 CET580723778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.656480074 CET37785807287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:06.656553030 CET580723778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.657332897 CET580723778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.662137985 CET37785807287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:06.662189007 CET580723778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:06.666985035 CET37785807287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.268687010 CET37785807287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.268856049 CET580723778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.268898964 CET580723778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.269490004 CET580743778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.274406910 CET37785807487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.274481058 CET580743778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.275305986 CET580743778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.280091047 CET37785807487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.280153036 CET580743778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.285013914 CET37785807487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.898154974 CET37785807487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.898293018 CET580743778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.898293018 CET580743778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.898819923 CET580763778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.903676033 CET37785807687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.903722048 CET580763778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.904402018 CET580763778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.909130096 CET37785807687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:07.909168959 CET580763778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:07.913981915 CET37785807687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:08.507508039 CET37785807687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:08.507769108 CET580763778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:08.507831097 CET580763778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:08.508429050 CET580783778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:08.513339996 CET37785807887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:08.513432026 CET580783778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:08.514132977 CET580783778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:08.519193888 CET37785807887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:08.519278049 CET580783778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:08.524110079 CET37785807887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.151838064 CET37785807887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.151957989 CET580783778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.152008057 CET580783778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.152522087 CET580803778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.157366037 CET37785808087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.157424927 CET580803778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.158365011 CET580803778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.163726091 CET37785808087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.163772106 CET580803778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.168739080 CET37785808087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.804157019 CET37785808087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.804358006 CET580803778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.804358006 CET580803778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.804889917 CET580823778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.809843063 CET37785808287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.809906960 CET580823778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.810689926 CET580823778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.815431118 CET37785808287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:09.815486908 CET580823778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:09.820276976 CET37785808287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:10.452828884 CET37785808287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:10.452939987 CET580823778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:10.453099012 CET580823778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:10.453839064 CET580843778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:10.458659887 CET37785808487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:10.458720922 CET580843778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:10.459723949 CET580843778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:10.464504004 CET37785808487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:10.464555025 CET580843778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:10.469749928 CET37785808487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.087616920 CET37785808487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.087737083 CET580843778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.087826014 CET580843778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.088526011 CET580863778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.093354940 CET37785808687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.093410015 CET580863778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.094264030 CET580863778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.099170923 CET37785808687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.099226952 CET580863778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.104036093 CET37785808687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.717816114 CET37785808687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.718012094 CET580863778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.718012094 CET580863778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.718575001 CET580883778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.723443031 CET37785808887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.723510027 CET580883778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.724288940 CET580883778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.729141951 CET37785808887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:11.729208946 CET580883778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:11.734040976 CET37785808887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.348908901 CET37785808887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.349047899 CET580883778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.349092007 CET580883778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.349606037 CET580903778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.354490042 CET37785809087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.354561090 CET580903778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.355211020 CET580903778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.360054016 CET37785809087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.360127926 CET580903778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.364998102 CET37785809087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.979355097 CET37785809087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.979496002 CET580903778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.979532003 CET580903778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.979960918 CET580923778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.984863043 CET37785809287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.984916925 CET580923778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.985548019 CET580923778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.990370035 CET37785809287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:12.990413904 CET580923778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:12.995368958 CET37785809287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:13.606992006 CET37785809287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:13.607151985 CET580923778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:13.607151985 CET580923778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:13.607666016 CET580943778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:13.613101959 CET37785809487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:13.613199949 CET580943778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:13.613986015 CET580943778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:13.618911982 CET37785809487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:13.618978977 CET580943778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:13.625699043 CET37785809487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.312372923 CET37785809487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.312494993 CET580943778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.312494993 CET580943778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.313024044 CET580963778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.317933083 CET37785809687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.318000078 CET580963778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.318595886 CET580963778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.323441982 CET37785809687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.323498011 CET580963778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.328286886 CET37785809687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.919971943 CET37785809687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.920154095 CET580963778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.920201063 CET580963778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.920804024 CET580983778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.925596952 CET37785809887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.925704956 CET580983778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.926446915 CET580983778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.931282997 CET37785809887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:14.931319952 CET580983778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:14.936072111 CET37785809887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:15.603663921 CET37785809887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:15.603759050 CET580983778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:15.603872061 CET580983778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:15.604620934 CET581003778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:15.609477043 CET37785810087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:15.609595060 CET581003778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:15.610735893 CET581003778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:15.615484953 CET37785810087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:15.615569115 CET581003778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:15.620366096 CET37785810087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.240622997 CET37785810087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.240834951 CET581003778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.240834951 CET581003778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.241518974 CET581023778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.246365070 CET37785810287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.246419907 CET581023778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.247178078 CET581023778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.251921892 CET37785810287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.251967907 CET581023778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.256759882 CET37785810287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.864120007 CET37785810287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.864201069 CET581023778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.864240885 CET581023778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.864737988 CET581043778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.869613886 CET37785810487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.869704008 CET581043778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.870317936 CET581043778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.875943899 CET37785810487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:16.876322031 CET581043778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:16.881086111 CET37785810487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:17.501080036 CET37785810487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:17.501354933 CET581043778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:17.501354933 CET581043778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:17.501735926 CET581063778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:17.506535053 CET37785810687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:17.506613016 CET581063778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:17.507364988 CET581063778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:17.512232065 CET37785810687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:17.512286901 CET581063778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:17.517076015 CET37785810687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.127109051 CET37785810687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.127214909 CET581063778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.127250910 CET581063778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.127837896 CET581083778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.132828951 CET37785810887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.132962942 CET581083778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.133639097 CET581083778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.138556004 CET37785810887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.138628960 CET581083778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.143405914 CET37785810887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.762418032 CET37785810887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.762520075 CET581083778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.762538910 CET581083778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.763019085 CET581103778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.767894983 CET37785811087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.767946959 CET581103778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.768590927 CET581103778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.773396969 CET37785811087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:18.773447037 CET581103778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:18.778342962 CET37785811087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:19.399389982 CET37785811087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:19.399499893 CET581103778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:19.399499893 CET581103778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:19.400224924 CET581123778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:19.404983044 CET37785811287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:19.405245066 CET581123778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:19.406503916 CET581123778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:19.411259890 CET37785811287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:19.411338091 CET581123778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:19.416124105 CET37785811287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.049103975 CET37785811287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.049316883 CET581123778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.049316883 CET581123778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.049810886 CET581143778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.054656982 CET37785811487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.054713964 CET581143778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.055459023 CET581143778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.060286999 CET37785811487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.060336113 CET581143778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.065180063 CET37785811487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.685513020 CET37785811487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.685600996 CET581143778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.685600996 CET581143778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.686465025 CET581163778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.691273928 CET37785811687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.691328049 CET581163778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.692151070 CET581163778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.697196007 CET37785811687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:20.697261095 CET581163778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:20.702771902 CET37785811687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:21.313313007 CET37785811687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:21.313450098 CET581163778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:21.313450098 CET581163778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:21.314233065 CET581183778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:21.319072962 CET37785811887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:21.319194078 CET581183778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:21.320964098 CET581183778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:21.328629971 CET37785811887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:21.328741074 CET581183778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:21.334608078 CET37785811887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.134526968 CET37785811887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.134609938 CET581183778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.134653091 CET581183778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.135060072 CET581203778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.139945030 CET37785812087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.140002012 CET581203778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.140830994 CET581203778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.145659924 CET37785812087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.145720005 CET581203778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.150691032 CET37785812087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.781799078 CET37785812087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.782036066 CET581203778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.782134056 CET581203778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.782748938 CET581223778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.787564039 CET37785812287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.787627935 CET581223778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.788872004 CET581223778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.793648958 CET37785812287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:22.793703079 CET581223778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:22.798484087 CET37785812287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:23.475140095 CET37785812287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:23.475253105 CET581223778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:23.475347996 CET581223778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:23.476155043 CET581243778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:23.481025934 CET37785812487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:23.481110096 CET581243778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:23.481815100 CET581243778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:23.486669064 CET37785812487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:23.486746073 CET581243778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:23.491566896 CET37785812487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.119319916 CET37785812487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.119473934 CET581243778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.119520903 CET581243778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.120008945 CET581263778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.125319958 CET37785812687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.125379086 CET581263778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.126061916 CET581263778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.130846024 CET37785812687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.130897045 CET581263778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.135698080 CET37785812687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.773098946 CET37785812687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.773195028 CET581263778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.773236990 CET581263778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.773753881 CET581283778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.780643940 CET37785812887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.780699968 CET581283778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.781414032 CET581283778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.786942959 CET37785812887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:24.786989927 CET581283778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:24.792454958 CET37785812887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:25.445801020 CET37785812887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:25.445910931 CET581283778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:25.446010113 CET581283778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:25.446825027 CET581303778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:25.451648951 CET37785813087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:25.451725960 CET581303778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:25.452728033 CET581303778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:25.457640886 CET37785813087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:25.457707882 CET581303778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:25.462523937 CET37785813087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.064372063 CET37785813087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.064526081 CET581303778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.064558029 CET581303778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.065105915 CET581323778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.069983959 CET37785813287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.070038080 CET581323778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.070708990 CET581323778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.075525045 CET37785813287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.075571060 CET581323778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.080380917 CET37785813287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.700973988 CET37785813287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.701091051 CET581323778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.701143980 CET581323778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.701661110 CET581343778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.709074020 CET37785813487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.709141970 CET581343778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.709830046 CET581343778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.716840029 CET37785813487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:26.716903925 CET581343778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:26.724386930 CET37785813487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.334244967 CET37785813487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.334374905 CET581343778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.334407091 CET581343778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.334861994 CET581363778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.339689016 CET37785813687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.339764118 CET581363778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.340384007 CET581363778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.345156908 CET37785813687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.345215082 CET581363778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.350069046 CET37785813687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.975502968 CET37785813687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.975672960 CET581363778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.975747108 CET581363778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.976454973 CET581383778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.981391907 CET37785813887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.981463909 CET581383778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.982516050 CET581383778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.987415075 CET37785813887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:27.987571955 CET581383778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:27.992398977 CET37785813887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:28.610143900 CET37785813887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:28.610243082 CET581383778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:28.610289097 CET581383778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:28.610729933 CET581403778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:28.616795063 CET37785814087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:28.616854906 CET581403778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:28.617535114 CET581403778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:28.623545885 CET37785814087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:28.623615980 CET581403778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:28.629533052 CET37785814087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.243221045 CET37785814087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.243345022 CET581403778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.243381023 CET581403778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.243953943 CET581423778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.248881102 CET37785814287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.248946905 CET581423778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.249711037 CET581423778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.254551888 CET37785814287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.254615068 CET581423778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.259439945 CET37785814287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.866152048 CET37785814287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.866383076 CET581423778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.866383076 CET581423778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.867002964 CET581443778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.871882915 CET37785814487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.871931076 CET581443778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.872884989 CET581443778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.877669096 CET37785814487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:29.877721071 CET581443778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:29.882515907 CET37785814487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:30.529344082 CET37785814487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:30.529455900 CET581443778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:30.529491901 CET581443778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:30.529944897 CET581463778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:30.535229921 CET37785814687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:30.535289049 CET581463778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:30.535834074 CET581463778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:30.540725946 CET37785814687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:30.540873051 CET581463778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:30.545710087 CET37785814687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.139012098 CET37785814687.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.139180899 CET581463778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.139297009 CET581463778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.140213013 CET581483778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.145129919 CET37785814887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.145198107 CET581483778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.146581888 CET581483778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.151396990 CET37785814887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.151454926 CET581483778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.156286001 CET37785814887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.786159039 CET37785814887.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.786236048 CET581483778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.786292076 CET581483778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.786895990 CET581503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.791722059 CET37785815087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.791790962 CET581503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.792702913 CET581503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.798791885 CET37785815087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:31.798865080 CET581503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:31.804883957 CET37785815087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:32.440989017 CET37785815087.121.84.183192.168.2.13
            Mar 10, 2025 20:33:32.441114902 CET581503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:32.441173077 CET581503778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:32.441644907 CET581523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:32.446418047 CET37785815287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:32.446491003 CET581523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:32.447185993 CET581523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:32.452219963 CET37785815287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:32.452292919 CET581523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:32.457130909 CET37785815287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:33.082016945 CET37785815287.121.84.183192.168.2.13
            Mar 10, 2025 20:33:33.082221031 CET581523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:33.082271099 CET581523778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:33.082767010 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:33.087589025 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:33.087651014 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:33.088404894 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:33.093261003 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:33.093328953 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:33.098104954 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:43.098882914 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:33:43.103998899 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:43.274247885 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:33:43.274360895 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:34:43.320705891 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:34:43.325763941 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:34:43.494307995 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:34:43.494417906 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:35:43.542634010 CET581543778192.168.2.1387.121.84.183
            Mar 10, 2025 20:35:43.547694921 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:35:43.712198019 CET37785815487.121.84.183192.168.2.13
            Mar 10, 2025 20:35:43.719978094 CET581543778192.168.2.1387.121.84.183
            TimestampSource PortDest PortSource IPDest IP
            Mar 10, 2025 20:35:42.990969896 CET3959553192.168.2.138.8.8.8
            Mar 10, 2025 20:35:42.991055012 CET5732753192.168.2.138.8.8.8
            Mar 10, 2025 20:35:42.997395039 CET53395958.8.8.8192.168.2.13
            Mar 10, 2025 20:35:42.997416019 CET53573278.8.8.8192.168.2.13
            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            Mar 10, 2025 20:35:42.990969896 CET192.168.2.138.8.8.80x28cfStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
            Mar 10, 2025 20:35:42.991055012 CET192.168.2.138.8.8.80x89b2Standard query (0)daisy.ubuntu.com28IN (0x0001)false
            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Mar 10, 2025 20:35:42.997395039 CET8.8.8.8192.168.2.130x28cfNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
            Mar 10, 2025 20:35:42.997395039 CET8.8.8.8192.168.2.130x28cfNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

            System Behavior

            Start time (UTC):19:32:58
            Start date (UTC):10/03/2025
            Path:/tmp/boatnet.spc.elf
            Arguments:/tmp/boatnet.spc.elf
            File size:4379400 bytes
            MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

            Start time (UTC):19:32:58
            Start date (UTC):10/03/2025
            Path:/tmp/boatnet.spc.elf
            Arguments:-
            File size:4379400 bytes
            MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

            Start time (UTC):19:32:58
            Start date (UTC):10/03/2025
            Path:/tmp/boatnet.spc.elf
            Arguments:-
            File size:4379400 bytes
            MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

            Start time (UTC):19:32:58
            Start date (UTC):10/03/2025
            Path:/tmp/boatnet.spc.elf
            Arguments:-
            File size:4379400 bytes
            MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Start time (UTC):19:32:59
            Start date (UTC):10/03/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76