Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1528122
MD5:	975118b578c49f90bbea29fbbb1e9571
SHA1:	e3284871c6a307a1001be651d370e0ad2c85145e
SHA256:	4c9d16b64450e2cb181d1b4948ed8a3633571fc995e11e732c64cb795b12b73b
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528122
Start date and time:	2024-10-07 16:17:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	5500
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	sh: 1: Syntax error: "(" unexpected

Process Tree

system is lnxubuntu20

na.elf (PID: 5500, Parent: 5422, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5502, Parent: 5500)

na.elf New Fork (PID: 5504, Parent: 5502)

sh (PID: 5504, Parent: 5502, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "]0;Central Control Terminal - 54 server(s) connected"

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 31%

Networking

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 56550 -> 999

Source: global traffic

TCP traffic: 192.168.2.14:56550 -> 129.152.30.246:999

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 129.152.30.246

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal52.troj.linELF@0/0@2/0

Source: /tmp/na.elf (PID: 5504)

Shell command executed: sh -c "]0;Central Control Terminal - 54 server(s) connected"

Jump to behavior

Source: submitted sample

Stderr: sh: 1: Syntax error: "(" unexpected: exit code = 0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 56550 -> 999

Source: /tmp/na.elf (PID: 5500)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 5500.1.00007ffcf6ead000.00007ffcf6ece000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5500.1.0000559a3617f000.0000559a362ad000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 5500.1.0000559a3617f000.0000559a362ad000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5500.1.00007ffcf6ead000.00007ffcf6ece000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	32%	ReversingLabs	Linux.Hacktool.Flooder

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
129.152.30.246	unknown	United States		14506	ORCL-ASHBURN3US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	na.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	2xl3rbZjPq.elf	Get hash	malicious	Mirai	Browse
	Rdih5xVXy1.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Sliver	Browse
	aqDJaFteog.elf	Get hash	malicious	Mirai	Browse
	3Gd0qX1f74.elf	Get hash	malicious	Mirai	Browse
	TmAQ4gFb8m.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai, Okiru	Browse
	na.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	na.elf	Get hash	malicious	Unknown	Browse
129.152.30.246	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	na.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.189.91.42
	na.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	WgRaU3h4k8.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	RdcuY1pZig.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2xl3rbZjPq.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	QJ1MJ1roKY.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Rdih5xVXy1.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
ORCL-ASHBURN3US	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	na.elf	Get hash	malicious	Unknown	Browse	129.152.30.246
	https://cpsess9329981231.pages.dev/robots.txt/	Get hash	malicious	Unknown	Browse	129.159.124.34

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.092910330851974
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	133'260 bytes
MD5:	975118b578c49f90bbea29fbbb1e9571
SHA1:	e3284871c6a307a1001be651d370e0ad2c85145e
SHA256:	4c9d16b64450e2cb181d1b4948ed8a3633571fc995e11e732c64cb795b12b73b
SHA512:	b6c8208d8a9c4724051b71e72b22b77c0d30e85da7ed8fa3f764c0ef1d8b947f62cd1bacc755c39286a0f583f79cff652521b381c21e151a29ab5454f7607141
SSDEEP:	3072:YpIzgGUYFc9X5AaRy1npx++iFiizB79aTbS2RFP98/:YOFUYc9JAaRyZpx++iFi67GbS2RFP98/
TLSH:	FAD30709EA429F01D5D235FAFB9E429873536FACE3F97111D9205F6023C6A9B0F76212
File Content Preview:	.ELF..............(.........4...l.......4. ...(........p.....j...j..................................\...\...............................xU..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	132460
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	19

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	4
.text	PROGBITS	0x80f0	0xf0	0x1cb1c	0x0	0x6	AX	0	16
.fini	PROGBITS	0x24c0c	0x1cc0c	0x10	0x0	0x6	AX	0	4
.rodata	PROGBITS	0x24c20	0x1cc20	0x1e54	0x0	0x2	A	0	8
.ARM.extab	PROGBITS	0x26a74	0x1ea74	0x30	0x0	0x2	A	0	4
.ARM.exidx	ARM_EXIDX	0x26aa4	0x1eaa4	0x1b8	0x0	0x82	AL	2	4
.eh_frame	PROGBITS	0x2f000	0x1f000	0x4	0x0	0x3	WA	0	4
.tdata	PROGBITS	0x2f004	0x1f004	0x4	0x0	0x403	WAT	0	4
.tbss	NOBITS	0x2f008	0x1f008	0x8	0x0	0x403	WAT	0	4
.init_array	INIT_ARRAY	0x2f008	0x1f008	0x4	0x0	0x3	WA	0	4
.fini_array	FINI_ARRAY	0x2f00c	0x1f00c	0x4	0x0	0x3	WA	0	4
.jcr	PROGBITS	0x2f010	0x1f010	0x4	0x0	0x3	WA	0	4
.data.rel.ro	PROGBITS	0x2f014	0x1f014	0x98	0x0	0x3	WA	0	4
.got	PROGBITS	0x2f0ac	0x1f0ac	0xd4	0x4	0x3	WA	0	4
.data	PROGBITS	0x2f180	0x1f180	0x24c	0x0	0x3	WA	0	4
.bss	NOBITS	0x2f3cc	0x1f3cc	0x51ac	0x0	0x3	WA	0	4
.comment	PROGBITS	0x0	0x1f3cc	0x10e4	0x0	0x0		0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x204b0	0x16	0x0	0x0		0	1
.shstrtab	STRTAB	0x0	0x204c6	0xa5	0x0	0x0		0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1eaa4	0x26aa4	0x26aa4	0x1b8	0x1b8	4.7926	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1ec5c	0x1ec5c	6.0858	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1f000	0x2f000	0x2f000	0x3cc	0x5578	4.1792	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .data.rel.ro .got .data .bss
TLS	0x1f004	0x2f004	0x2f004	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 16:17:58.922705889 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:17:58.927968979 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:17:58.928033113 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:17:58.930567026 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:17:58.935489893 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:17:59.555912971 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:17:59.556015015 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:17:59.623769045 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:17:59.628828049 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:00.625019073 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:00.630265951 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:01.626112938 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:01.631040096 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:02.627273083 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:02.633985996 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:03.628467083 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:03.633486032 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:04.629517078 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:04.634432077 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:05.630587101 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:05.635459900 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:06.631640911 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:06.639061928 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:06.851489067 CEST	46540	443	192.168.2.14	185.125.190.26
Oct 7, 2024 16:18:07.632661104 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:07.639791965 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:08.633765936 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:08.642724037 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:09.634896040 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:09.642570019 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:10.636559010 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:10.641649008 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:11.637320995 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:11.647190094 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:12.638277054 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:12.817183018 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:13.639440060 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:13.644862890 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:14.640506029 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:14.645683050 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:15.641628981 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:15.646723032 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:16.642847061 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:16.648236036 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:17.643956900 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:17.649074078 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:18.645092964 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:18.650176048 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:19.646277905 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:19.651511908 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:20.647433996 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:20.652554035 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:21.648535967 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:21.653759956 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:22.649662018 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:22.654575109 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:23.650723934 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:23.655925035 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:24.651716948 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:24.656683922 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:25.652838945 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:25.657881021 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:26.653891087 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:26.658854961 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:27.655082941 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:27.661683083 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:28.656147957 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:28.661235094 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:29.657277107 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:29.662210941 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:30.658406019 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:30.663429976 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:31.659589052 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:31.664566040 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:32.660689116 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:32.665636063 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:33.661778927 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:33.667292118 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:34.662847996 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:34.667764902 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:35.663933992 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:35.669027090 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:36.665062904 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:36.670118093 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:37.666099072 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:37.671114922 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:38.082166910 CEST	46540	443	192.168.2.14	185.125.190.26
Oct 7, 2024 16:18:38.667206049 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:38.672473907 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:39.668293953 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:39.673949003 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:40.669452906 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:40.675113916 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:41.670603991 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:41.676162958 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:42.671674013 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:42.677918911 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:43.672919989 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:43.677872896 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:44.674139023 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:44.679286957 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:45.675275087 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:45.680536985 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:46.676321983 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:46.681418896 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:47.677443027 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:47.682622910 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:48.678610086 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:48.683676004 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:49.679728031 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:49.684726954 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:50.680942059 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:50.685970068 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:51.681961060 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:51.802706957 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:52.683064938 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:52.688015938 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:53.684250116 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:53.690166950 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:54.685158014 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:54.690299034 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:55.686367989 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:55.905459881 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:56.125438929 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:56.562736034 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:56.562752962 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:56.562763929 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:56.687514067 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:56.692531109 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:57.688637018 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:57.693690062 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:58.689685106 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:58.694720984 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:18:59.690737963 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:18:59.695693970 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:00.692042112 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:00.697457075 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:01.693103075 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:01.698411942 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:02.694080114 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:02.699862957 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:03.695425987 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:03.700364113 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:04.696365118 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:04.725444078 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:05.697382927 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:05.702208996 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:06.698411942 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:06.703289032 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:07.699456930 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:07.704504967 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:08.700531006 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:08.705439091 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:09.701683044 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:09.858462095 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:10.702862978 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:10.707734108 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:11.703823090 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:11.709064960 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:12.705012083 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:12.709958076 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:13.706352949 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:13.711417913 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:14.707422972 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:14.712447882 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:15.708605051 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:15.713517904 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:16.709783077 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:16.714720964 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:17.711023092 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:17.717117071 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:18.712120056 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:18.717093945 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:19.713280916 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:19.733586073 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:20.714354038 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:20.719196081 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:21.715430975 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:21.720748901 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:22.716548920 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:22.721405983 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:23.717685938 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:23.722613096 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:24.718908072 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:24.723752975 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:25.720025063 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:25.725081921 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:26.721091986 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:26.725878000 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:27.722138882 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:27.727212906 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:28.723278999 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:28.728085995 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:29.724351883 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:29.729223967 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:30.725454092 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:30.835514069 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:31.726542950 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:31.731580019 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:32.727555037 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:32.732666969 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:33.728768110 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:33.733867884 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:34.729809046 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:34.735972881 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:35.730942965 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:35.735737085 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:36.732057095 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:36.737023115 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:37.733110905 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:37.738166094 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:38.734195948 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:38.739033937 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:39.735352039 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:39.740171909 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:40.736465931 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:40.741636992 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:41.737574100 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:41.742372990 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:42.738810062 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:42.743716955 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:43.739914894 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:43.745035887 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:44.741163015 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:44.746681929 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:45.742316008 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:45.747140884 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:46.743514061 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:46.748420000 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:47.744616032 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:47.749478102 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:48.745666027 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:48.750538111 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:49.746752977 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:49.751564026 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:50.747885942 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:50.752805948 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:51.749176025 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:51.754168987 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:52.750068903 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:52.755244970 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:53.751355886 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:53.756630898 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:54.752468109 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:54.757549047 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:55.753595114 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:55.758857012 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:56.754693985 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:56.759902954 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:57.755775928 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:57.761001110 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:58.756968975 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:58.761986017 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:19:59.758183956 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:19:59.763470888 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:00.759311914 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:00.764568090 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:01.760399103 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:01.765517950 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:02.761499882 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:02.767508030 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:03.762557030 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:03.767692089 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:04.763792992 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:04.768985033 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:05.765120029 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:05.770188093 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:06.766189098 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:06.771065950 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:07.767324924 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:07.772715092 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:08.768594980 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:08.775332928 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:09.769725084 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:09.774837017 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:10.770863056 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:10.776223898 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:11.772165060 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:11.777355909 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:12.773309946 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:12.982129097 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:13.184499979 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:13.184591055 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:13.774393082 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:13.779280901 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:14.775465965 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:14.880093098 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:15.776873112 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:15.782123089 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:16.777925968 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:16.783659935 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:17.779131889 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:17.784172058 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:18.780226946 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:19.069901943 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:19.187719107 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:19.187747955 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:19.781364918 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:19.786300898 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:20.782562017 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:20.787406921 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:21.783689976 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:21.788640022 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:22.784847975 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:22.789902925 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:23.785967112 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:23.921994925 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:24.787071943 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:24.791939020 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:25.788260937 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:25.793220997 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:26.789478064 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:26.794708014 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:27.790630102 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:27.795743942 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:28.791718006 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:28.796822071 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:29.792835951 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:29.798064947 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:30.793849945 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:30.799020052 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:31.795013905 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:31.800096035 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:32.796122074 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:32.801290035 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:33.797303915 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:33.802202940 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:34.798527956 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:34.803818941 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:35.801160097 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:35.806030035 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:36.800856113 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:36.805927992 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:37.802166939 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:37.807056904 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:38.803282976 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:38.808554888 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:39.804452896 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:39.809436083 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:40.805618048 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:40.810714006 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:41.806687117 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:41.813998938 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:42.807809114 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:42.812794924 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:43.808861971 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:43.813828945 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:44.810004950 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:44.815006971 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:45.811170101 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:45.816210032 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:46.812218904 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:46.817013025 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:47.813486099 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:47.818573952 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:48.814698935 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:48.819694996 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:49.815831900 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:49.955647945 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:50.816950083 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:50.822448015 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:51.818157911 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:51.823263884 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:52.819160938 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:52.824165106 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:53.819746017 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:53.824518919 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:54.819623947 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:54.824482918 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:55.820759058 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:55.825839043 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:56.821866989 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:56.826720953 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:57.823415041 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:57.828394890 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:58.824378014 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:58.829546928 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:20:59.825587034 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:20:59.830910921 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:00.826622963 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:00.831512928 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:01.827589989 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:01.832407951 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:02.828612089 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:02.833806038 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:03.829787970 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:04.029391050 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:04.830892086 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:04.835892916 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:05.831996918 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:05.836772919 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:06.833180904 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:06.837991953 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:07.834415913 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:07.839978933 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:08.835674047 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:08.840595961 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:09.836836100 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:09.841555119 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:10.837933064 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:10.842977047 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:11.839108944 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:11.843993902 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:12.840243101 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:12.845053911 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:13.841319084 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:13.846633911 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:14.842420101 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:14.847201109 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:15.843487978 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:15.848365068 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:16.844613075 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:16.849422932 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:17.845710039 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:17.850451946 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:18.846821070 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:18.851730108 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:19.847897053 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:19.977636099 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:20.848963976 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:20.853749037 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:21.849997044 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:21.854821920 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:22.851103067 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:22.856388092 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:23.852236986 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:23.857841969 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:24.853516102 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:24.858333111 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:25.854553938 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:25.860714912 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:26.855725050 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:26.860769987 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:27.856937885 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:27.862179995 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:28.858143091 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:28.862981081 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:29.859246016 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:29.864434958 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:30.860374928 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:30.865263939 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:31.861366987 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:31.866266012 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:32.862400055 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:32.867225885 CEST	999	56550	129.152.30.246	192.168.2.14
Oct 7, 2024 16:21:33.863471031 CEST	56550	999	192.168.2.14	129.152.30.246
Oct 7, 2024 16:21:33.869662046 CEST	999	56550	129.152.30.246	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 16:20:41.572927952 CEST	39476	53	192.168.2.14	1.1.1.1
Oct 7, 2024 16:20:41.572983027 CEST	34983	53	192.168.2.14	1.1.1.1
Oct 7, 2024 16:20:41.580980062 CEST	53	34983	1.1.1.1	192.168.2.14
Oct 7, 2024 16:20:41.581753016 CEST	53	39476	1.1.1.1	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 16:20:41.572927952 CEST	192.168.2.14	1.1.1.1	0x13eb	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:20:41.572983027 CEST	192.168.2.14	1.1.1.1	0x5031	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 16:20:41.581753016 CEST	1.1.1.1	192.168.2.14	0x13eb	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:20:41.581753016 CEST	1.1.1.1	192.168.2.14	0x13eb	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.14	56550	129.152.30.246	999

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 16:17:58.930567026 CEST	44	OUT	CONNECT arm7 absolutecontrol!!! Data Raw: Data Ascii:

System Behavior

Analysis Process: na.elf PID: 5500, Parent PID: 5422

General

Start time (UTC):	14:17:57
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 5502, Parent PID: 5500

General

Start time (UTC):	14:17:58
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 5504, Parent PID: 5502

General

Start time (UTC):	14:17:58
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5504, Parent PID: 5502

General

Start time (UTC):	14:17:58
Start date (UTC):	07/10/2024
Path:	/bin/sh
Arguments:	sh -c "]0;Central Control Terminal - 54 server(s) connected"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: na.elf PID: 5500, Parent PID: 5422

General

Chronological Activities

Analysis Process: na.elf PID: 5502, Parent PID: 5500

General

Chronological Activities

Analysis Process: na.elf PID: 5504, Parent PID: 5502

General

Chronological Activities

Analysis Process: sh PID: 5504, Parent PID: 5502

General

Chronological Activities

Linux Analysis Report
na.elf