Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1646585
MD5:	84f6600098a7ffd79c0d1d2b3561022c
SHA1:	816e28410202debd9bb33a5ee5adca4ffceb210f
SHA256:	feeff674c195b3afcc964d71281ddb2c8f366e30ce12137c7b00b79b2a5ac966
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646585
Start date and time:	2025-03-24 06:18:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@50/0

Warnings

VT rate limit hit for: 198.98.51.68

Runtime Messages

Command:	/tmp/x86.elf
PID:	5572
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	skidmark botnet
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 5572, Parent: 5497, MD5: 84f6600098a7ffd79c0d1d2b3561022c) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 5573, Parent: 5572)

x86.elf New Fork (PID: 5574, Parent: 5573)

x86.elf New Fork (PID: 5575, Parent: 5573)

x86.elf New Fork (PID: 5576, Parent: 5573)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xd4f:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x2b50:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8df6:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x45f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x7ff6:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x67f0:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5576.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x45c2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xd4f:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x2b50:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8df6:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x45f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x7ff6:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x67f0:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5572.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x45c2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86.elf

ReversingLabs: Detection: 19%

Source: unknown

DNS traffic detected: query: 198.98.51.68 replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139

Source: global traffic

DNS traffic detected: DNS query: 198.98.51.68

Source: x86.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5576.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5572.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal60.evad.linELF@0/0@50/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3895/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5575)	File opened: /proc/270/cmdline	Jump to behavior

Source: x86.elf

Submission file: segment LOAD with 7.8804 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86.elf	19%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.98.51.68	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
175.30.53.20	unknown	China		4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
175.30.53.20	x86_64.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	gjsoX84ZOy.elf	Get hash	malicious	Mirai	Browse
	skwXrj6q72.elf	Get hash	malicious	Unknown	Browse
	VqY324s7TO.elf	Get hash	malicious	Unknown	Browse
	1v1A4KluJp.elf	Get hash	malicious	Unknown	Browse
	fI2JqkDmZj.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINANET-BACKBONENo31Jin-rongStreetCN	x86_64.elf	Get hash	malicious	Unknown	Browse	175.30.53.20
	arm.elf	Get hash	malicious	Unknown	Browse	175.30.53.20
	mpsl.elf	Get hash	malicious	Unknown	Browse	175.30.53.20
	resgod.arm.elf	Get hash	malicious	Mirai	Browse	223.8.175.23
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	223.8.175.35
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	223.8.175.39
	resgod.mips.elf	Get hash	malicious	Mirai	Browse	223.8.175.35
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse	223.8.175.38
	resgod.ppc.elf	Get hash	malicious	Mirai	Browse	223.8.175.37
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	223.8.175.23

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.876189945139115
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86.elf
File size:	27'180 bytes
MD5:	84f6600098a7ffd79c0d1d2b3561022c
SHA1:	816e28410202debd9bb33a5ee5adca4ffceb210f
SHA256:	feeff674c195b3afcc964d71281ddb2c8f366e30ce12137c7b00b79b2a5ac966
SHA512:	a3eeea30b58f250d721bd089f4a9c2def1532cecaa5f70922006d23c22361db08b89fb2a7df6144960920d74c92c5ec9788baf8a1526a89ce9d821c0db688632
SSDEEP:	768:op2yUILNsxUpj3BX5vP8hAlihyle8PzH3Odu:op2F72x8hTyVHP
TLSH:	57C2E129850EBF5FC9546E72134A5DBE4DF4BCA017EFD1D12C58084B276A0AC6CB0E47
File Content Preview:	.ELF....................0q..4...........4. ...(.....................+i..+i..............`...`y..`y..................Q.td...............................tUPX!....................^........?d..ELF.......d.......4....4. (.......k.-.#.\|.......=......A......>.r.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc07130
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x692b	0x692b	7.8804	0x5	R E	0x1000
LOAD	0x960	0x8057960	0x8057960	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 87
• 53 (DNS)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 06:19:38.187649012 CET	54116	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:39.188914061 CET	54116	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:41.204860926 CET	54116	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:45.364763021 CET	54116	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:49.234806061 CET	54118	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:50.260632992 CET	54118	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:52.276552916 CET	54118	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:19:56.372495890 CET	54118	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:00.093164921 CET	54120	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:01.108325005 CET	54120	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:03.124252081 CET	54120	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:07.380151033 CET	54120	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:11.016341925 CET	54122	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:12.020013094 CET	54122	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:14.036147118 CET	54122	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:18.131886959 CET	54122	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:46.051156044 CET	54124	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:47.059075117 CET	54124	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:49.075059891 CET	54124	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:53.202946901 CET	54124	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:57.100472927 CET	54126	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:20:58.130801916 CET	54126	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:00.146745920 CET	54126	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:04.210830927 CET	54126	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:07.956974983 CET	54128	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:08.978738070 CET	54128	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:10.994647026 CET	54128	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:15.218619108 CET	54128	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:18.945929050 CET	54130	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:19.954261065 CET	54130	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:21.970176935 CET	54130	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:26.226116896 CET	54130	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:29.800331116 CET	54132	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:30.801976919 CET	54132	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:32.817940950 CET	54132	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:36.977840900 CET	54132	23	192.168.2.15	175.30.53.20
Mar 24, 2025 06:21:40.306853056 CET	54134	23	192.168.2.15	175.30.53.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 06:19:37.218995094 CET	41673	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:19:37.486259937 CET	53	41673	51.158.108.203	192.168.2.15
Mar 24, 2025 06:19:37.486418009 CET	33060	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:19:37.661875010 CET	53	33060	51.158.108.203	192.168.2.15
Mar 24, 2025 06:19:37.662022114 CET	59403	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:19:37.837088108 CET	53	59403	51.158.108.203	192.168.2.15
Mar 24, 2025 06:19:37.837243080 CET	52615	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:19:38.011631012 CET	53	52615	51.158.108.203	192.168.2.15
Mar 24, 2025 06:19:38.011782885 CET	32780	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:19:38.187515974 CET	53	32780	51.158.108.203	192.168.2.15
Mar 24, 2025 06:19:48.197577953 CET	36746	53	192.168.2.15	81.169.136.222
Mar 24, 2025 06:19:48.405495882 CET	53	36746	81.169.136.222	192.168.2.15
Mar 24, 2025 06:19:48.405766964 CET	43386	53	192.168.2.15	81.169.136.222
Mar 24, 2025 06:19:48.612797976 CET	53	43386	81.169.136.222	192.168.2.15
Mar 24, 2025 06:19:48.613101959 CET	49360	53	192.168.2.15	81.169.136.222
Mar 24, 2025 06:19:48.822654963 CET	53	49360	81.169.136.222	192.168.2.15
Mar 24, 2025 06:19:48.822844982 CET	35099	53	192.168.2.15	81.169.136.222
Mar 24, 2025 06:19:49.051115036 CET	53	35099	81.169.136.222	192.168.2.15
Mar 24, 2025 06:19:49.051347017 CET	43471	53	192.168.2.15	81.169.136.222
Mar 24, 2025 06:19:49.234555960 CET	53	43471	81.169.136.222	192.168.2.15
Mar 24, 2025 06:19:59.244755030 CET	51384	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:19:59.416222095 CET	53	51384	195.10.195.195	192.168.2.15
Mar 24, 2025 06:19:59.416548967 CET	39272	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:19:59.585874081 CET	53	39272	195.10.195.195	192.168.2.15
Mar 24, 2025 06:19:59.586050034 CET	44862	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:19:59.754744053 CET	53	44862	195.10.195.195	192.168.2.15
Mar 24, 2025 06:19:59.754923105 CET	46823	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:19:59.923748970 CET	53	46823	195.10.195.195	192.168.2.15
Mar 24, 2025 06:19:59.924046040 CET	57408	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:20:00.092971087 CET	53	57408	195.10.195.195	192.168.2.15
Mar 24, 2025 06:20:10.094707966 CET	59074	53	192.168.2.15	51.77.149.139
Mar 24, 2025 06:20:10.282424927 CET	53	59074	51.77.149.139	192.168.2.15
Mar 24, 2025 06:20:10.282582998 CET	48950	53	192.168.2.15	51.77.149.139
Mar 24, 2025 06:20:10.463174105 CET	53	48950	51.77.149.139	192.168.2.15
Mar 24, 2025 06:20:10.463318110 CET	55303	53	192.168.2.15	51.77.149.139
Mar 24, 2025 06:20:10.641274929 CET	53	55303	51.77.149.139	192.168.2.15
Mar 24, 2025 06:20:10.641397953 CET	35584	53	192.168.2.15	51.77.149.139
Mar 24, 2025 06:20:10.835606098 CET	53	35584	51.77.149.139	192.168.2.15
Mar 24, 2025 06:20:10.835927963 CET	44777	53	192.168.2.15	51.77.149.139
Mar 24, 2025 06:20:11.016204119 CET	53	44777	51.77.149.139	192.168.2.15
Mar 24, 2025 06:20:21.026221037 CET	51663	53	192.168.2.15	178.254.22.166
Mar 24, 2025 06:20:26.031197071 CET	40896	53	192.168.2.15	178.254.22.166
Mar 24, 2025 06:20:31.036161900 CET	52831	53	192.168.2.15	178.254.22.166
Mar 24, 2025 06:20:36.041162968 CET	51967	53	192.168.2.15	178.254.22.166
Mar 24, 2025 06:20:41.046246052 CET	34218	53	192.168.2.15	178.254.22.166
Mar 24, 2025 06:20:56.060086012 CET	37239	53	192.168.2.15	185.181.61.24
Mar 24, 2025 06:20:56.256870985 CET	53	37239	185.181.61.24	192.168.2.15
Mar 24, 2025 06:20:56.257083893 CET	44365	53	192.168.2.15	185.181.61.24
Mar 24, 2025 06:20:56.480242014 CET	53	44365	185.181.61.24	192.168.2.15
Mar 24, 2025 06:20:56.480650902 CET	43546	53	192.168.2.15	185.181.61.24
Mar 24, 2025 06:20:56.677431107 CET	53	43546	185.181.61.24	192.168.2.15
Mar 24, 2025 06:20:56.677625895 CET	50427	53	192.168.2.15	185.181.61.24
Mar 24, 2025 06:20:56.902800083 CET	53	50427	185.181.61.24	192.168.2.15
Mar 24, 2025 06:20:56.903136015 CET	33655	53	192.168.2.15	185.181.61.24
Mar 24, 2025 06:20:57.100229025 CET	53	33655	185.181.61.24	192.168.2.15
Mar 24, 2025 06:21:07.106796980 CET	47903	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:07.275691032 CET	53	47903	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:07.276168108 CET	40567	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:07.446822882 CET	53	40567	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:07.447288036 CET	49554	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:07.617966890 CET	53	49554	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:07.618469954 CET	55886	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:07.786973000 CET	53	55886	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:07.787405014 CET	53274	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:07.956460953 CET	53	53274	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:17.966409922 CET	34230	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:21:18.240370989 CET	53	34230	51.158.108.203	192.168.2.15
Mar 24, 2025 06:21:18.240684032 CET	33667	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:21:18.414995909 CET	53	33667	51.158.108.203	192.168.2.15
Mar 24, 2025 06:21:18.415203094 CET	42451	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:21:18.591900110 CET	53	42451	51.158.108.203	192.168.2.15
Mar 24, 2025 06:21:18.592206955 CET	48974	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:21:18.769524097 CET	53	48974	51.158.108.203	192.168.2.15
Mar 24, 2025 06:21:18.769793034 CET	45374	53	192.168.2.15	51.158.108.203
Mar 24, 2025 06:21:18.945784092 CET	53	45374	51.158.108.203	192.168.2.15
Mar 24, 2025 06:21:28.954082966 CET	51688	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:29.124423027 CET	53	51688	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:29.124667883 CET	41252	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:29.293060064 CET	53	41252	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:29.293313980 CET	39426	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:29.461601973 CET	53	39426	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:29.462126017 CET	35098	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:29.630666971 CET	53	35098	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:29.630928993 CET	46159	53	192.168.2.15	195.10.195.195
Mar 24, 2025 06:21:29.800165892 CET	53	46159	195.10.195.195	192.168.2.15
Mar 24, 2025 06:21:39.809820890 CET	54503	53	192.168.2.15	134.195.4.2
Mar 24, 2025 06:21:39.907480001 CET	53	54503	134.195.4.2	192.168.2.15
Mar 24, 2025 06:21:39.907972097 CET	57507	53	192.168.2.15	134.195.4.2
Mar 24, 2025 06:21:40.007348061 CET	53	57507	134.195.4.2	192.168.2.15
Mar 24, 2025 06:21:40.007606030 CET	51566	53	192.168.2.15	134.195.4.2
Mar 24, 2025 06:21:40.104954958 CET	53	51566	134.195.4.2	192.168.2.15
Mar 24, 2025 06:21:40.105248928 CET	50121	53	192.168.2.15	134.195.4.2
Mar 24, 2025 06:21:40.204768896 CET	53	50121	134.195.4.2	192.168.2.15
Mar 24, 2025 06:21:40.205084085 CET	44047	53	192.168.2.15	134.195.4.2
Mar 24, 2025 06:21:40.306413889 CET	53	44047	134.195.4.2	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2025 06:19:37.218995094 CET	192.168.2.15	51.158.108.203	0x5971	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:37.486418009 CET	192.168.2.15	51.158.108.203	0x5971	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:37.662022114 CET	192.168.2.15	51.158.108.203	0x5971	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:37.837243080 CET	192.168.2.15	51.158.108.203	0x5971	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:38.011782885 CET	192.168.2.15	51.158.108.203	0x5971	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.197577953 CET	192.168.2.15	81.169.136.222	0xa5e	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.405766964 CET	192.168.2.15	81.169.136.222	0xa5e	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.613101959 CET	192.168.2.15	81.169.136.222	0xa5e	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.822844982 CET	192.168.2.15	81.169.136.222	0xa5e	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:49.051347017 CET	192.168.2.15	81.169.136.222	0xa5e	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.244755030 CET	192.168.2.15	195.10.195.195	0x1c81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.416548967 CET	192.168.2.15	195.10.195.195	0x1c81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.586050034 CET	192.168.2.15	195.10.195.195	0x1c81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.754923105 CET	192.168.2.15	195.10.195.195	0x1c81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.924046040 CET	192.168.2.15	195.10.195.195	0x1c81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.094707966 CET	192.168.2.15	51.77.149.139	0x32e7	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.282582998 CET	192.168.2.15	51.77.149.139	0x32e7	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.463318110 CET	192.168.2.15	51.77.149.139	0x32e7	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.641397953 CET	192.168.2.15	51.77.149.139	0x32e7	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.835927963 CET	192.168.2.15	51.77.149.139	0x32e7	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:21.026221037 CET	192.168.2.15	178.254.22.166	0x8127	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:26.031197071 CET	192.168.2.15	178.254.22.166	0x8127	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:31.036161900 CET	192.168.2.15	178.254.22.166	0x8127	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:36.041162968 CET	192.168.2.15	178.254.22.166	0x8127	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:41.046246052 CET	192.168.2.15	178.254.22.166	0x8127	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.060086012 CET	192.168.2.15	185.181.61.24	0xfb2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.257083893 CET	192.168.2.15	185.181.61.24	0xfb2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.480650902 CET	192.168.2.15	185.181.61.24	0xfb2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.677625895 CET	192.168.2.15	185.181.61.24	0xfb2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.903136015 CET	192.168.2.15	185.181.61.24	0xfb2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.106796980 CET	192.168.2.15	195.10.195.195	0xfc94	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.276168108 CET	192.168.2.15	195.10.195.195	0xfc94	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.447288036 CET	192.168.2.15	195.10.195.195	0xfc94	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.618469954 CET	192.168.2.15	195.10.195.195	0xfc94	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.787405014 CET	192.168.2.15	195.10.195.195	0xfc94	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:17.966409922 CET	192.168.2.15	51.158.108.203	0xbff4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.240684032 CET	192.168.2.15	51.158.108.203	0xbff4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.415203094 CET	192.168.2.15	51.158.108.203	0xbff4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.592206955 CET	192.168.2.15	51.158.108.203	0xbff4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.769793034 CET	192.168.2.15	51.158.108.203	0xbff4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:28.954082966 CET	192.168.2.15	195.10.195.195	0xedbb	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.124667883 CET	192.168.2.15	195.10.195.195	0xedbb	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.293313980 CET	192.168.2.15	195.10.195.195	0xedbb	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.462126017 CET	192.168.2.15	195.10.195.195	0xedbb	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.630928993 CET	192.168.2.15	195.10.195.195	0xedbb	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:39.809820890 CET	192.168.2.15	134.195.4.2	0x42b9	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:39.907972097 CET	192.168.2.15	134.195.4.2	0x42b9	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.007606030 CET	192.168.2.15	134.195.4.2	0x42b9	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.105248928 CET	192.168.2.15	134.195.4.2	0x42b9	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.205084085 CET	192.168.2.15	134.195.4.2	0x42b9	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 24, 2025 06:19:37.486259937 CET	51.158.108.203	192.168.2.15	0x5971	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:37.661875010 CET	51.158.108.203	192.168.2.15	0x5971	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:37.837088108 CET	51.158.108.203	192.168.2.15	0x5971	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:38.011631012 CET	51.158.108.203	192.168.2.15	0x5971	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:38.187515974 CET	51.158.108.203	192.168.2.15	0x5971	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.405495882 CET	81.169.136.222	192.168.2.15	0xa5e	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.612797976 CET	81.169.136.222	192.168.2.15	0xa5e	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:48.822654963 CET	81.169.136.222	192.168.2.15	0xa5e	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:49.051115036 CET	81.169.136.222	192.168.2.15	0xa5e	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:49.234555960 CET	81.169.136.222	192.168.2.15	0xa5e	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.416222095 CET	195.10.195.195	192.168.2.15	0x1c81	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.585874081 CET	195.10.195.195	192.168.2.15	0x1c81	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.754744053 CET	195.10.195.195	192.168.2.15	0x1c81	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:19:59.923748970 CET	195.10.195.195	192.168.2.15	0x1c81	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:00.092971087 CET	195.10.195.195	192.168.2.15	0x1c81	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.282424927 CET	51.77.149.139	192.168.2.15	0x32e7	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.463174105 CET	51.77.149.139	192.168.2.15	0x32e7	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.641274929 CET	51.77.149.139	192.168.2.15	0x32e7	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:10.835606098 CET	51.77.149.139	192.168.2.15	0x32e7	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:11.016204119 CET	51.77.149.139	192.168.2.15	0x32e7	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.256870985 CET	185.181.61.24	192.168.2.15	0xfb2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.480242014 CET	185.181.61.24	192.168.2.15	0xfb2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.677431107 CET	185.181.61.24	192.168.2.15	0xfb2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:56.902800083 CET	185.181.61.24	192.168.2.15	0xfb2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:20:57.100229025 CET	185.181.61.24	192.168.2.15	0xfb2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.275691032 CET	195.10.195.195	192.168.2.15	0xfc94	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.446822882 CET	195.10.195.195	192.168.2.15	0xfc94	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.617966890 CET	195.10.195.195	192.168.2.15	0xfc94	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.786973000 CET	195.10.195.195	192.168.2.15	0xfc94	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:07.956460953 CET	195.10.195.195	192.168.2.15	0xfc94	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.240370989 CET	51.158.108.203	192.168.2.15	0xbff4	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.414995909 CET	51.158.108.203	192.168.2.15	0xbff4	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.591900110 CET	51.158.108.203	192.168.2.15	0xbff4	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.769524097 CET	51.158.108.203	192.168.2.15	0xbff4	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:18.945784092 CET	51.158.108.203	192.168.2.15	0xbff4	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.124423027 CET	195.10.195.195	192.168.2.15	0xedbb	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.293060064 CET	195.10.195.195	192.168.2.15	0xedbb	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.461601973 CET	195.10.195.195	192.168.2.15	0xedbb	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.630666971 CET	195.10.195.195	192.168.2.15	0xedbb	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:29.800165892 CET	195.10.195.195	192.168.2.15	0xedbb	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:39.907480001 CET	134.195.4.2	192.168.2.15	0x42b9	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.007348061 CET	134.195.4.2	192.168.2.15	0x42b9	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.104954958 CET	134.195.4.2	192.168.2.15	0x42b9	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.204768896 CET	134.195.4.2	192.168.2.15	0x42b9	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:21:40.306413889 CET	134.195.4.2	192.168.2.15	0x42b9	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86.elf PID: 5572, Parent PID: 5497

General

Start time (UTC):	05:19:36
Start date (UTC):	24/03/2025
Path:	/tmp/x86.elf
Arguments:	/tmp/x86.elf
File size:	27180 bytes
MD5 hash:	84f6600098a7ffd79c0d1d2b3561022c

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: x86.elf PID: 5573, Parent PID: 5572

General

Start time (UTC):	05:19:36
Start date (UTC):	24/03/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	27180 bytes
MD5 hash:	84f6600098a7ffd79c0d1d2b3561022c

Process Activities

Process Forked

Chronological Activities

Analysis Process: x86.elf PID: 5574, Parent PID: 5573

General

Start time (UTC):	05:19:36
Start date (UTC):	24/03/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	27180 bytes
MD5 hash:	84f6600098a7ffd79c0d1d2b3561022c

File Activities

File Opened

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: x86.elf PID: 5575, Parent PID: 5573

General

Start time (UTC):	05:19:36
Start date (UTC):	24/03/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	27180 bytes
MD5 hash:	84f6600098a7ffd79c0d1d2b3561022c

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: x86.elf PID: 5576, Parent PID: 5573

General

Start time (UTC):	05:19:36
Start date (UTC):	24/03/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	27180 bytes
MD5 hash:	84f6600098a7ffd79c0d1d2b3561022c

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86.elf PID: 5572, Parent PID: 5497

General

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: x86.elf PID: 5573, Parent PID: 5572

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: x86.elf PID: 5574, Parent PID: 5573

General

File Activities

File Opened

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: x86.elf PID: 5575, Parent PID: 5573

General

Linux Analysis Report
x86.elf