Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527377
MD5:	d69e35a0ff37e0a5958faf55cb5a33b7
SHA1:	94f43a5891b932d0191537a5030e9c00b01e69b3
SHA256:	1a8dee4a9a71e04bd9d6942d0a35bad2ecc53c7ac64175e7bc7c636101c7bd44
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527377
Start date and time:	2024-10-06 23:11:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal96.troj.linELF@0/0@125/0

Runtime Messages

Command:	/tmp/na.elf
PID:	5551
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5551, Parent: 5478, MD5: d69e35a0ff37e0a5958faf55cb5a33b7) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5552, Parent: 5551)

na.elf New Fork (PID: 5553, Parent: 5552)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
na.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x32f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
na.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8655:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
na.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x4f62:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
na.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb628:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
na.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9ec9:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
na.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x4f32:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5551.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5551.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5551.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x32f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8655:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x4f62:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb628:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9ec9:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5551.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x4f32:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: na.elf PID: 5551	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5551	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5551	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5551	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xce5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 9 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 63%

Machine Learning detection for sample

Source: na.elf

Joe Sandbox ML: detected

Source: na.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Performs DNS queries to domains with low reputation

Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz

Source: unknown

DNS traffic detected: query: nianlun-vps.xyz replaycode: Name error (3)

Source: global traffic

DNS traffic detected: DNS query: nianlun-vps.xyz

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.troj.linELF@0/0@125/0

Source: /tmp/na.elf (PID: 5553)	File opened: /proc/5388/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3886/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5553)	File opened: /proc/3788/cmdline	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5551.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
na.elf	63%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Z.A
na.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nianlun-vps.xyz	unknown	unknown	true		unknown

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.714524981710515
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	na.elf
File size:	89'576 bytes
MD5:	d69e35a0ff37e0a5958faf55cb5a33b7
SHA1:	94f43a5891b932d0191537a5030e9c00b01e69b3
SHA256:	1a8dee4a9a71e04bd9d6942d0a35bad2ecc53c7ac64175e7bc7c636101c7bd44
SHA512:	831427acd036ee6900aba417b90bff784f2e261b9f51fa360e59ebfa35032a68815eb069fa2b7133e456dfb7dc9b6df13199256ee4c8e9479b06f02bf0f0c17e
SSDEEP:	1536:xpmWc2AcighsZ82fJxfcHAHD1mSsM8meUigBQ9TnkISGtAd00xZ:xpmX2riED2frfSAHhmLVUBQ9kVT00x
TLSH:	0E936CC5F683D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B6C
File Content Preview:	.ELF....................d...4...X\......4. ...(......................................................G..8...........Q.td............................U..S........$...h........[]...$.............U......= ....t..5...................u........t....h............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	89176
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xf136	0x0	0x6	AX	16
.fini	PROGBITS	0x80571e6	0xf1e6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8057200	0xf200	0x2290	0x0	0x2	A	32
.ctors	PROGBITS	0x805a494	0x11494	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805a4a0	0x114a0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805a4c0	0x114c0	0x4758	0x0	0x3	WA	32
.bss	NOBITS	0x805ec20	0x15c18	0x49ac	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x15c18	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x11490	0x11490	6.5882	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11494	0x805a494	0x805a494	0x4784	0x9138	0.3643	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:12:01.570250034 CEST	56353	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:01.604960918 CEST	53	56353	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:01.605070114 CEST	50444	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:01.614651918 CEST	53	50444	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:01.614726067 CEST	43643	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:01.621793985 CEST	53	43643	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:01.621922970 CEST	44092	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:01.631001949 CEST	53	44092	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:01.631062031 CEST	49165	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:01.664565086 CEST	53	49165	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:03.674624920 CEST	35841	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:03.692595005 CEST	53	35841	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:03.692878008 CEST	45479	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:03.700118065 CEST	53	45479	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:03.700197935 CEST	53926	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:03.735893965 CEST	53	53926	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:03.736025095 CEST	52495	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:03.743110895 CEST	53	52495	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:03.743200064 CEST	47993	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:03.750256062 CEST	53	47993	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:06.755302906 CEST	50525	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:06.762746096 CEST	53	50525	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:06.762852907 CEST	58887	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:06.769193888 CEST	53	58887	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:06.769355059 CEST	56528	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:06.776426077 CEST	53	56528	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:06.776485920 CEST	52854	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:06.784223080 CEST	53	52854	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:06.784846067 CEST	39683	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:06.820214033 CEST	53	39683	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:13.824681997 CEST	48256	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:13.832715988 CEST	53	48256	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:13.832823038 CEST	55672	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:13.839761019 CEST	53	55672	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:13.839837074 CEST	57006	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:13.848095894 CEST	53	57006	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:13.848156929 CEST	40443	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:13.855464935 CEST	53	40443	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:13.855542898 CEST	41583	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:13.862330914 CEST	53	41583	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:18.863279104 CEST	42987	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:18.870361090 CEST	53	42987	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:18.870490074 CEST	41838	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:18.877629042 CEST	53	41838	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:18.877743959 CEST	37153	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:18.884742975 CEST	53	37153	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:18.884829998 CEST	52758	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:18.895167112 CEST	53	52758	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:18.895239115 CEST	59840	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:18.902069092 CEST	53	59840	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:26.903801918 CEST	45122	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:26.910994053 CEST	53	45122	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:26.911192894 CEST	49749	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:26.918128967 CEST	53	49749	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:26.918217897 CEST	47062	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:26.927757025 CEST	53	47062	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:26.927845001 CEST	39182	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:26.934324980 CEST	53	39182	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:26.934505939 CEST	60977	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:26.941467047 CEST	53	60977	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:27.944901943 CEST	54897	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:27.952119112 CEST	53	54897	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:27.952253103 CEST	48889	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:27.958473921 CEST	53	48889	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:27.958547115 CEST	46861	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:27.965500116 CEST	53	46861	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:27.965564966 CEST	48981	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:27.972556114 CEST	53	48981	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:27.972626925 CEST	36238	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:27.979866028 CEST	53	36238	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:37.982383966 CEST	40022	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:37.990212917 CEST	53	40022	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:37.990575075 CEST	33675	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:37.997894049 CEST	53	33675	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:37.997975111 CEST	49879	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:38.005942106 CEST	53	49879	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:38.006000042 CEST	42537	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:38.012768984 CEST	53	42537	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:38.012826920 CEST	46013	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:38.019932985 CEST	53	46013	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:46.021318913 CEST	59495	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:46.028389931 CEST	53	59495	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:46.028522015 CEST	35846	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:46.035876989 CEST	53	35846	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:46.035970926 CEST	58784	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:46.042994022 CEST	53	58784	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:46.043066978 CEST	42497	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:46.050200939 CEST	53	42497	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:46.050272942 CEST	60253	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:46.057404995 CEST	53	60253	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:50.060543060 CEST	48130	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:50.068209887 CEST	53	48130	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:50.068445921 CEST	45621	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:50.075280905 CEST	53	45621	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:50.075400114 CEST	41953	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:50.082515001 CEST	53	41953	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:50.082765102 CEST	55391	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:50.089683056 CEST	53	55391	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:50.090034008 CEST	38358	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:50.096708059 CEST	53	38358	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:56.099428892 CEST	55661	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:56.106791019 CEST	53	55661	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:56.106909037 CEST	47497	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:56.117613077 CEST	53	47497	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:56.117690086 CEST	39197	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:56.125456095 CEST	53	39197	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:56.125525951 CEST	35666	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:56.132447004 CEST	53	35666	8.8.8.8	192.168.2.15
Oct 6, 2024 23:12:56.132530928 CEST	42851	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:12:56.141590118 CEST	53	42851	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:04.143523932 CEST	33972	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:04.150482893 CEST	53	33972	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:04.150568008 CEST	52300	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:04.157680035 CEST	53	52300	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:04.157757998 CEST	52776	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:04.164843082 CEST	53	52776	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:04.164912939 CEST	50165	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:04.171849012 CEST	53	50165	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:04.171915054 CEST	46112	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:04.178817987 CEST	53	46112	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:06.180587053 CEST	33638	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:06.187489033 CEST	53	33638	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:06.187606096 CEST	49498	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:06.194621086 CEST	53	49498	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:06.194786072 CEST	40328	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:06.201663017 CEST	53	40328	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:06.201740026 CEST	39408	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:06.208764076 CEST	53	39408	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:06.208868980 CEST	36378	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:06.216362000 CEST	53	36378	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:08.217881918 CEST	37721	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:08.225969076 CEST	53	37721	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:08.226078033 CEST	60874	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:08.233073950 CEST	53	60874	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:08.233223915 CEST	44719	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:08.239337921 CEST	53	44719	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:08.239411116 CEST	50247	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:08.246644020 CEST	53	50247	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:08.246725082 CEST	49793	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:08.253858089 CEST	53	49793	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:17.256073952 CEST	58057	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:17.263411999 CEST	53	58057	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:17.266175985 CEST	47466	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:17.273480892 CEST	53	47466	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:17.273766994 CEST	43459	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:17.280190945 CEST	53	43459	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:17.280497074 CEST	43639	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:17.287451029 CEST	53	43639	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:17.287753105 CEST	59596	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:17.294929981 CEST	53	59596	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:25.297144890 CEST	43405	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:25.304831982 CEST	53	43405	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:25.305079937 CEST	54245	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:25.312098980 CEST	53	54245	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:25.312339067 CEST	44473	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:25.319210052 CEST	53	44473	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:25.319413900 CEST	36344	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:25.326445103 CEST	53	36344	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:25.326704979 CEST	52039	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:25.333301067 CEST	53	52039	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:31.335509062 CEST	34216	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:31.342308044 CEST	53	34216	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:31.342518091 CEST	59352	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:31.349777937 CEST	53	59352	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:31.349855900 CEST	54295	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:31.357182026 CEST	53	54295	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:31.357270002 CEST	56496	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:31.363929987 CEST	53	56496	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:31.364018917 CEST	38025	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:31.371118069 CEST	53	38025	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:32.372653008 CEST	37645	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:32.379815102 CEST	53	37645	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:32.379925966 CEST	59219	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:32.386271954 CEST	53	59219	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:32.386360884 CEST	51215	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:32.392926931 CEST	53	51215	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:32.393064976 CEST	57535	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:32.400007963 CEST	53	57535	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:32.400079966 CEST	57539	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:32.406815052 CEST	53	57539	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:36.408780098 CEST	45275	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:36.415431976 CEST	53	45275	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:36.415689945 CEST	36041	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:36.423106909 CEST	53	36041	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:36.423260927 CEST	60961	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:36.430252075 CEST	53	60961	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:36.430339098 CEST	34963	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:36.437289953 CEST	53	34963	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:36.437387943 CEST	44291	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:36.444600105 CEST	53	44291	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:42.447570086 CEST	46118	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:42.454988956 CEST	53	46118	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:42.455327034 CEST	53694	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:42.461983919 CEST	53	53694	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:42.462264061 CEST	35291	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:42.469255924 CEST	53	35291	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:42.469434023 CEST	48944	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:42.475883007 CEST	53	48944	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:42.476032972 CEST	38817	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:42.483131886 CEST	53	38817	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:44.485342979 CEST	38023	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:44.491853952 CEST	53	38023	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:44.491961002 CEST	46696	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:44.498986006 CEST	53	46696	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:44.499098063 CEST	44830	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:44.506277084 CEST	53	44830	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:44.506351948 CEST	35670	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:44.512736082 CEST	53	35670	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:44.512818098 CEST	47737	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:44.519864082 CEST	53	47737	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:47.522113085 CEST	59103	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:47.529633999 CEST	53	59103	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:47.529781103 CEST	54803	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:47.536506891 CEST	53	54803	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:47.536604881 CEST	49437	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:47.544317961 CEST	53	49437	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:47.544404030 CEST	49046	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:47.552715063 CEST	53	49046	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:47.552808046 CEST	53910	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:47.560040951 CEST	53	53910	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:50.562285900 CEST	60825	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:50.569677114 CEST	53	60825	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:50.569771051 CEST	39189	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:50.576498032 CEST	53	39189	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:50.576566935 CEST	57988	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:50.583679914 CEST	53	57988	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:50.583745003 CEST	50234	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:50.590843916 CEST	53	50234	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:50.590933084 CEST	44368	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:50.598186970 CEST	53	44368	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:58.599908113 CEST	52176	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:58.607808113 CEST	53	52176	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:58.607944965 CEST	38041	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:58.615299940 CEST	53	38041	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:58.615442038 CEST	37160	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:58.622375011 CEST	53	37160	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:58.622509956 CEST	52858	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:58.629582882 CEST	53	52858	8.8.8.8	192.168.2.15
Oct 6, 2024 23:13:58.629688025 CEST	39509	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:13:58.636272907 CEST	53	39509	8.8.8.8	192.168.2.15
Oct 6, 2024 23:14:03.637784004 CEST	46845	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:14:03.645448923 CEST	53	46845	8.8.8.8	192.168.2.15
Oct 6, 2024 23:14:03.645593882 CEST	52325	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:14:03.652482986 CEST	53	52325	8.8.8.8	192.168.2.15
Oct 6, 2024 23:14:03.652627945 CEST	41287	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:14:03.659476995 CEST	53	41287	8.8.8.8	192.168.2.15
Oct 6, 2024 23:14:03.659570932 CEST	47955	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:14:03.665997028 CEST	53	47955	8.8.8.8	192.168.2.15
Oct 6, 2024 23:14:03.666074991 CEST	56234	53	192.168.2.15	8.8.8.8
Oct 6, 2024 23:14:03.672851086 CEST	53	56234	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 23:12:01.570250034 CEST	192.168.2.15	8.8.8.8	0xb88e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.605070114 CEST	192.168.2.15	8.8.8.8	0xb88e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.614726067 CEST	192.168.2.15	8.8.8.8	0xb88e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.621922970 CEST	192.168.2.15	8.8.8.8	0xb88e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.631062031 CEST	192.168.2.15	8.8.8.8	0xb88e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.674624920 CEST	192.168.2.15	8.8.8.8	0x39c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.692878008 CEST	192.168.2.15	8.8.8.8	0x39c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.700197935 CEST	192.168.2.15	8.8.8.8	0x39c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.736025095 CEST	192.168.2.15	8.8.8.8	0x39c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.743200064 CEST	192.168.2.15	8.8.8.8	0x39c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.755302906 CEST	192.168.2.15	8.8.8.8	0x4f5c	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.762852907 CEST	192.168.2.15	8.8.8.8	0x4f5c	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.769355059 CEST	192.168.2.15	8.8.8.8	0x4f5c	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.776485920 CEST	192.168.2.15	8.8.8.8	0x4f5c	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.784846067 CEST	192.168.2.15	8.8.8.8	0x4f5c	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.824681997 CEST	192.168.2.15	8.8.8.8	0x564e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.832823038 CEST	192.168.2.15	8.8.8.8	0x564e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.839837074 CEST	192.168.2.15	8.8.8.8	0x564e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.848156929 CEST	192.168.2.15	8.8.8.8	0x564e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.855542898 CEST	192.168.2.15	8.8.8.8	0x564e	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.863279104 CEST	192.168.2.15	8.8.8.8	0x50d9	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.870490074 CEST	192.168.2.15	8.8.8.8	0x50d9	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.877743959 CEST	192.168.2.15	8.8.8.8	0x50d9	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.884829998 CEST	192.168.2.15	8.8.8.8	0x50d9	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.895239115 CEST	192.168.2.15	8.8.8.8	0x50d9	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.903801918 CEST	192.168.2.15	8.8.8.8	0xd179	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.911192894 CEST	192.168.2.15	8.8.8.8	0xd179	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.918217897 CEST	192.168.2.15	8.8.8.8	0xd179	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.927845001 CEST	192.168.2.15	8.8.8.8	0xd179	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.934505939 CEST	192.168.2.15	8.8.8.8	0xd179	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.944901943 CEST	192.168.2.15	8.8.8.8	0x9308	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.952253103 CEST	192.168.2.15	8.8.8.8	0x9308	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.958547115 CEST	192.168.2.15	8.8.8.8	0x9308	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.965564966 CEST	192.168.2.15	8.8.8.8	0x9308	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.972626925 CEST	192.168.2.15	8.8.8.8	0x9308	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:37.982383966 CEST	192.168.2.15	8.8.8.8	0x24f1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:37.990575075 CEST	192.168.2.15	8.8.8.8	0x24f1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:37.997975111 CEST	192.168.2.15	8.8.8.8	0x24f1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:38.006000042 CEST	192.168.2.15	8.8.8.8	0x24f1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:38.012826920 CEST	192.168.2.15	8.8.8.8	0x24f1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.021318913 CEST	192.168.2.15	8.8.8.8	0xacff	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.028522015 CEST	192.168.2.15	8.8.8.8	0xacff	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.035970926 CEST	192.168.2.15	8.8.8.8	0xacff	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.043066978 CEST	192.168.2.15	8.8.8.8	0xacff	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.050272942 CEST	192.168.2.15	8.8.8.8	0xacff	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.060543060 CEST	192.168.2.15	8.8.8.8	0x3219	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.068445921 CEST	192.168.2.15	8.8.8.8	0x3219	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.075400114 CEST	192.168.2.15	8.8.8.8	0x3219	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.082765102 CEST	192.168.2.15	8.8.8.8	0x3219	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.090034008 CEST	192.168.2.15	8.8.8.8	0x3219	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.099428892 CEST	192.168.2.15	8.8.8.8	0xaefc	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.106909037 CEST	192.168.2.15	8.8.8.8	0xaefc	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.117690086 CEST	192.168.2.15	8.8.8.8	0xaefc	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.125525951 CEST	192.168.2.15	8.8.8.8	0xaefc	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.132530928 CEST	192.168.2.15	8.8.8.8	0xaefc	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.143523932 CEST	192.168.2.15	8.8.8.8	0x3110	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.150568008 CEST	192.168.2.15	8.8.8.8	0x3110	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.157757998 CEST	192.168.2.15	8.8.8.8	0x3110	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.164912939 CEST	192.168.2.15	8.8.8.8	0x3110	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.171915054 CEST	192.168.2.15	8.8.8.8	0x3110	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.180587053 CEST	192.168.2.15	8.8.8.8	0x23c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.187606096 CEST	192.168.2.15	8.8.8.8	0x23c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.194786072 CEST	192.168.2.15	8.8.8.8	0x23c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.201740026 CEST	192.168.2.15	8.8.8.8	0x23c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.208868980 CEST	192.168.2.15	8.8.8.8	0x23c1	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.217881918 CEST	192.168.2.15	8.8.8.8	0x9459	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.226078033 CEST	192.168.2.15	8.8.8.8	0x9459	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.233223915 CEST	192.168.2.15	8.8.8.8	0x9459	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.239411116 CEST	192.168.2.15	8.8.8.8	0x9459	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.246725082 CEST	192.168.2.15	8.8.8.8	0x9459	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.256073952 CEST	192.168.2.15	8.8.8.8	0xaa7d	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.266175985 CEST	192.168.2.15	8.8.8.8	0xaa7d	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.273766994 CEST	192.168.2.15	8.8.8.8	0xaa7d	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.280497074 CEST	192.168.2.15	8.8.8.8	0xaa7d	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.287753105 CEST	192.168.2.15	8.8.8.8	0xaa7d	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.297144890 CEST	192.168.2.15	8.8.8.8	0x7d61	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.305079937 CEST	192.168.2.15	8.8.8.8	0x7d61	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.312339067 CEST	192.168.2.15	8.8.8.8	0x7d61	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.319413900 CEST	192.168.2.15	8.8.8.8	0x7d61	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.326704979 CEST	192.168.2.15	8.8.8.8	0x7d61	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.335509062 CEST	192.168.2.15	8.8.8.8	0x453b	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.342518091 CEST	192.168.2.15	8.8.8.8	0x453b	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.349855900 CEST	192.168.2.15	8.8.8.8	0x453b	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.357270002 CEST	192.168.2.15	8.8.8.8	0x453b	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.364018917 CEST	192.168.2.15	8.8.8.8	0x453b	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.372653008 CEST	192.168.2.15	8.8.8.8	0x7903	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.379925966 CEST	192.168.2.15	8.8.8.8	0x7903	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.386360884 CEST	192.168.2.15	8.8.8.8	0x7903	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.393064976 CEST	192.168.2.15	8.8.8.8	0x7903	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.400079966 CEST	192.168.2.15	8.8.8.8	0x7903	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.408780098 CEST	192.168.2.15	8.8.8.8	0x8bfb	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.415689945 CEST	192.168.2.15	8.8.8.8	0x8bfb	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.423260927 CEST	192.168.2.15	8.8.8.8	0x8bfb	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.430339098 CEST	192.168.2.15	8.8.8.8	0x8bfb	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.437387943 CEST	192.168.2.15	8.8.8.8	0x8bfb	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.447570086 CEST	192.168.2.15	8.8.8.8	0xd004	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.455327034 CEST	192.168.2.15	8.8.8.8	0xd004	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.462264061 CEST	192.168.2.15	8.8.8.8	0xd004	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.469434023 CEST	192.168.2.15	8.8.8.8	0xd004	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.476032972 CEST	192.168.2.15	8.8.8.8	0xd004	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.485342979 CEST	192.168.2.15	8.8.8.8	0xa762	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.491961002 CEST	192.168.2.15	8.8.8.8	0xa762	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.499098063 CEST	192.168.2.15	8.8.8.8	0xa762	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.506351948 CEST	192.168.2.15	8.8.8.8	0xa762	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.512818098 CEST	192.168.2.15	8.8.8.8	0xa762	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.522113085 CEST	192.168.2.15	8.8.8.8	0x4438	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.529781103 CEST	192.168.2.15	8.8.8.8	0x4438	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.536604881 CEST	192.168.2.15	8.8.8.8	0x4438	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.544404030 CEST	192.168.2.15	8.8.8.8	0x4438	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.552808046 CEST	192.168.2.15	8.8.8.8	0x4438	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.562285900 CEST	192.168.2.15	8.8.8.8	0x7338	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.569771051 CEST	192.168.2.15	8.8.8.8	0x7338	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.576566935 CEST	192.168.2.15	8.8.8.8	0x7338	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.583745003 CEST	192.168.2.15	8.8.8.8	0x7338	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.590933084 CEST	192.168.2.15	8.8.8.8	0x7338	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.599908113 CEST	192.168.2.15	8.8.8.8	0x2858	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.607944965 CEST	192.168.2.15	8.8.8.8	0x2858	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.615442038 CEST	192.168.2.15	8.8.8.8	0x2858	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.622509956 CEST	192.168.2.15	8.8.8.8	0x2858	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.629688025 CEST	192.168.2.15	8.8.8.8	0x2858	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.637784004 CEST	192.168.2.15	8.8.8.8	0x2975	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.645593882 CEST	192.168.2.15	8.8.8.8	0x2975	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.652627945 CEST	192.168.2.15	8.8.8.8	0x2975	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.659570932 CEST	192.168.2.15	8.8.8.8	0x2975	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.666074991 CEST	192.168.2.15	8.8.8.8	0x2975	Standard query (0)	nianlun-vps.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 23:12:01.604960918 CEST	8.8.8.8	192.168.2.15	0xb88e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.614651918 CEST	8.8.8.8	192.168.2.15	0xb88e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.621793985 CEST	8.8.8.8	192.168.2.15	0xb88e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.631001949 CEST	8.8.8.8	192.168.2.15	0xb88e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:01.664565086 CEST	8.8.8.8	192.168.2.15	0xb88e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.692595005 CEST	8.8.8.8	192.168.2.15	0x39c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.700118065 CEST	8.8.8.8	192.168.2.15	0x39c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.735893965 CEST	8.8.8.8	192.168.2.15	0x39c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.743110895 CEST	8.8.8.8	192.168.2.15	0x39c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:03.750256062 CEST	8.8.8.8	192.168.2.15	0x39c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.762746096 CEST	8.8.8.8	192.168.2.15	0x4f5c	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.769193888 CEST	8.8.8.8	192.168.2.15	0x4f5c	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.776426077 CEST	8.8.8.8	192.168.2.15	0x4f5c	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.784223080 CEST	8.8.8.8	192.168.2.15	0x4f5c	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:06.820214033 CEST	8.8.8.8	192.168.2.15	0x4f5c	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.832715988 CEST	8.8.8.8	192.168.2.15	0x564e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.839761019 CEST	8.8.8.8	192.168.2.15	0x564e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.848095894 CEST	8.8.8.8	192.168.2.15	0x564e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.855464935 CEST	8.8.8.8	192.168.2.15	0x564e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:13.862330914 CEST	8.8.8.8	192.168.2.15	0x564e	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.870361090 CEST	8.8.8.8	192.168.2.15	0x50d9	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.877629042 CEST	8.8.8.8	192.168.2.15	0x50d9	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.884742975 CEST	8.8.8.8	192.168.2.15	0x50d9	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.895167112 CEST	8.8.8.8	192.168.2.15	0x50d9	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:18.902069092 CEST	8.8.8.8	192.168.2.15	0x50d9	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.910994053 CEST	8.8.8.8	192.168.2.15	0xd179	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.918128967 CEST	8.8.8.8	192.168.2.15	0xd179	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.927757025 CEST	8.8.8.8	192.168.2.15	0xd179	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.934324980 CEST	8.8.8.8	192.168.2.15	0xd179	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:26.941467047 CEST	8.8.8.8	192.168.2.15	0xd179	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.952119112 CEST	8.8.8.8	192.168.2.15	0x9308	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.958473921 CEST	8.8.8.8	192.168.2.15	0x9308	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.965500116 CEST	8.8.8.8	192.168.2.15	0x9308	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.972556114 CEST	8.8.8.8	192.168.2.15	0x9308	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:27.979866028 CEST	8.8.8.8	192.168.2.15	0x9308	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:37.990212917 CEST	8.8.8.8	192.168.2.15	0x24f1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:37.997894049 CEST	8.8.8.8	192.168.2.15	0x24f1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:38.005942106 CEST	8.8.8.8	192.168.2.15	0x24f1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:38.012768984 CEST	8.8.8.8	192.168.2.15	0x24f1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:38.019932985 CEST	8.8.8.8	192.168.2.15	0x24f1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.028389931 CEST	8.8.8.8	192.168.2.15	0xacff	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.035876989 CEST	8.8.8.8	192.168.2.15	0xacff	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.042994022 CEST	8.8.8.8	192.168.2.15	0xacff	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.050200939 CEST	8.8.8.8	192.168.2.15	0xacff	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:46.057404995 CEST	8.8.8.8	192.168.2.15	0xacff	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.068209887 CEST	8.8.8.8	192.168.2.15	0x3219	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.075280905 CEST	8.8.8.8	192.168.2.15	0x3219	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.082515001 CEST	8.8.8.8	192.168.2.15	0x3219	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.089683056 CEST	8.8.8.8	192.168.2.15	0x3219	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:50.096708059 CEST	8.8.8.8	192.168.2.15	0x3219	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.106791019 CEST	8.8.8.8	192.168.2.15	0xaefc	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.117613077 CEST	8.8.8.8	192.168.2.15	0xaefc	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.125456095 CEST	8.8.8.8	192.168.2.15	0xaefc	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.132447004 CEST	8.8.8.8	192.168.2.15	0xaefc	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:12:56.141590118 CEST	8.8.8.8	192.168.2.15	0xaefc	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.150482893 CEST	8.8.8.8	192.168.2.15	0x3110	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.157680035 CEST	8.8.8.8	192.168.2.15	0x3110	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.164843082 CEST	8.8.8.8	192.168.2.15	0x3110	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.171849012 CEST	8.8.8.8	192.168.2.15	0x3110	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:04.178817987 CEST	8.8.8.8	192.168.2.15	0x3110	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.187489033 CEST	8.8.8.8	192.168.2.15	0x23c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.194621086 CEST	8.8.8.8	192.168.2.15	0x23c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.201663017 CEST	8.8.8.8	192.168.2.15	0x23c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.208764076 CEST	8.8.8.8	192.168.2.15	0x23c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:06.216362000 CEST	8.8.8.8	192.168.2.15	0x23c1	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.225969076 CEST	8.8.8.8	192.168.2.15	0x9459	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.233073950 CEST	8.8.8.8	192.168.2.15	0x9459	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.239337921 CEST	8.8.8.8	192.168.2.15	0x9459	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.246644020 CEST	8.8.8.8	192.168.2.15	0x9459	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:08.253858089 CEST	8.8.8.8	192.168.2.15	0x9459	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.263411999 CEST	8.8.8.8	192.168.2.15	0xaa7d	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.273480892 CEST	8.8.8.8	192.168.2.15	0xaa7d	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.280190945 CEST	8.8.8.8	192.168.2.15	0xaa7d	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.287451029 CEST	8.8.8.8	192.168.2.15	0xaa7d	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:17.294929981 CEST	8.8.8.8	192.168.2.15	0xaa7d	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.304831982 CEST	8.8.8.8	192.168.2.15	0x7d61	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.312098980 CEST	8.8.8.8	192.168.2.15	0x7d61	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.319210052 CEST	8.8.8.8	192.168.2.15	0x7d61	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.326445103 CEST	8.8.8.8	192.168.2.15	0x7d61	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:25.333301067 CEST	8.8.8.8	192.168.2.15	0x7d61	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.342308044 CEST	8.8.8.8	192.168.2.15	0x453b	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.349777937 CEST	8.8.8.8	192.168.2.15	0x453b	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.357182026 CEST	8.8.8.8	192.168.2.15	0x453b	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.363929987 CEST	8.8.8.8	192.168.2.15	0x453b	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:31.371118069 CEST	8.8.8.8	192.168.2.15	0x453b	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.379815102 CEST	8.8.8.8	192.168.2.15	0x7903	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.386271954 CEST	8.8.8.8	192.168.2.15	0x7903	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.392926931 CEST	8.8.8.8	192.168.2.15	0x7903	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.400007963 CEST	8.8.8.8	192.168.2.15	0x7903	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:32.406815052 CEST	8.8.8.8	192.168.2.15	0x7903	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.415431976 CEST	8.8.8.8	192.168.2.15	0x8bfb	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.423106909 CEST	8.8.8.8	192.168.2.15	0x8bfb	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.430252075 CEST	8.8.8.8	192.168.2.15	0x8bfb	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.437289953 CEST	8.8.8.8	192.168.2.15	0x8bfb	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:36.444600105 CEST	8.8.8.8	192.168.2.15	0x8bfb	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.454988956 CEST	8.8.8.8	192.168.2.15	0xd004	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.461983919 CEST	8.8.8.8	192.168.2.15	0xd004	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.469255924 CEST	8.8.8.8	192.168.2.15	0xd004	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.475883007 CEST	8.8.8.8	192.168.2.15	0xd004	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:42.483131886 CEST	8.8.8.8	192.168.2.15	0xd004	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.491853952 CEST	8.8.8.8	192.168.2.15	0xa762	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.498986006 CEST	8.8.8.8	192.168.2.15	0xa762	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.506277084 CEST	8.8.8.8	192.168.2.15	0xa762	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.512736082 CEST	8.8.8.8	192.168.2.15	0xa762	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:44.519864082 CEST	8.8.8.8	192.168.2.15	0xa762	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.529633999 CEST	8.8.8.8	192.168.2.15	0x4438	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.536506891 CEST	8.8.8.8	192.168.2.15	0x4438	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.544317961 CEST	8.8.8.8	192.168.2.15	0x4438	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.552715063 CEST	8.8.8.8	192.168.2.15	0x4438	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:47.560040951 CEST	8.8.8.8	192.168.2.15	0x4438	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.569677114 CEST	8.8.8.8	192.168.2.15	0x7338	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.576498032 CEST	8.8.8.8	192.168.2.15	0x7338	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.583679914 CEST	8.8.8.8	192.168.2.15	0x7338	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.590843916 CEST	8.8.8.8	192.168.2.15	0x7338	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:50.598186970 CEST	8.8.8.8	192.168.2.15	0x7338	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.607808113 CEST	8.8.8.8	192.168.2.15	0x2858	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.615299940 CEST	8.8.8.8	192.168.2.15	0x2858	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.622375011 CEST	8.8.8.8	192.168.2.15	0x2858	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.629582882 CEST	8.8.8.8	192.168.2.15	0x2858	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:13:58.636272907 CEST	8.8.8.8	192.168.2.15	0x2858	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.645448923 CEST	8.8.8.8	192.168.2.15	0x2975	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.652482986 CEST	8.8.8.8	192.168.2.15	0x2975	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.659476995 CEST	8.8.8.8	192.168.2.15	0x2975	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.665997028 CEST	8.8.8.8	192.168.2.15	0x2975	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:14:03.672851086 CEST	8.8.8.8	192.168.2.15	0x2975	Name error (3)	nianlun-vps.xyz	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 5551, Parent PID: 5478

General

Start time (UTC):	21:12:01
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	89576 bytes
MD5 hash:	d69e35a0ff37e0a5958faf55cb5a33b7

Start time (UTC):	21:12:01
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	89576 bytes
MD5 hash:	d69e35a0ff37e0a5958faf55cb5a33b7

Start time (UTC):	21:12:01
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	89576 bytes
MD5 hash:	d69e35a0ff37e0a5958faf55cb5a33b7

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 5551, Parent PID: 5478

General

Chronological Activities

Analysis Process: na.elf PID: 5552, Parent PID: 5551

General

Chronological Activities

Analysis Process: na.elf PID: 5553, Parent PID: 5552

General

Chronological Activities

Linux Analysis Report
na.elf