Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
vwkjebwi686.elf

Overview

General Information

Sample name:vwkjebwi686.elf
Analysis ID:1541232
MD5:27003f9fb179560f2e11332739d43e99
SHA1:c3931743b3e3519b3a0791990179475592340ddd
SHA256:98ece0b04ea95bccb968941630f024879207d8e9d4cb4491211ed6d3104c95eb
Tags:user-elfdigest
Infos:

Detection

Mirai, Okiru
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Yara detected Mirai
Yara detected Okiru
Machine Learning detection for sample
Sample deletes itself
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1541232
Start date and time:2024-10-24 15:41:04 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 50s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:vwkjebwi686.elf
Detection:MAL
Classification:mal84.troj.evad.linELF@0/0@26/0
  • VT rate limit hit for: vwkjebwi686.elf
Command:/tmp/vwkjebwi686.elf
PID:6265
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
about to cum inside a femboy btw
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
vwkjebwi686.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    vwkjebwi686.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      vwkjebwi686.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x13328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1333c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1338c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1342c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1347c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      vwkjebwi686.elfLinux_Trojan_Mirai_268aac0bunknownunknown
      • 0x6caf:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
      vwkjebwi686.elfLinux_Trojan_Mirai_0cb1699cunknownunknown
      • 0x6c62:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
      Click to see the 4 entries
      SourceRuleDescriptionAuthorStrings
      6265.1.0000000008048000.000000000805e000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
        6265.1.0000000008048000.000000000805e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6265.1.0000000008048000.000000000805e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x13328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1333c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1338c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1342c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1347c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          6265.1.0000000008048000.000000000805e000.r-x.sdmpLinux_Trojan_Mirai_268aac0bunknownunknown
          • 0x6caf:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
          6265.1.0000000008048000.000000000805e000.r-x.sdmpLinux_Trojan_Mirai_0cb1699cunknownunknown
          • 0x6c62:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
          Click to see the 7 entries
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: vwkjebwi686.elfAvira: detected
          Source: vwkjebwi686.elfJoe Sandbox ML: detected
          Source: vwkjebwi686.elfString: /proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverraw.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/proc/self/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

          Networking

          barindex
          Source: global trafficDNS traffic detected: malformed DNS query: raw.eye-network.ru. [malformed]
          Source: global trafficTCP traffic: 192.168.2.23:59020 -> 213.232.235.18:33966
          Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
          Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
          Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: global trafficDNS traffic detected: DNS query: raw.eye-network.ru
          Source: global trafficDNS traffic detected: DNS query: raw.eye-network.ru. [malformed]
          Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

          System Summary

          barindex
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
          Source: Process Memory Space: vwkjebwi686.elf PID: 6265, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: Initial sampleString containing 'busybox' found: /bin/busybox
          Source: Initial sampleString containing 'busybox' found: /proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverraw.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/proc/self/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
          Source: vwkjebwi686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
          Source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
          Source: Process Memory Space: vwkjebwi686.elf PID: 6265, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: classification engineClassification label: mal84.troj.evad.linELF@0/0@26/0
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1582/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/3088/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/230/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/110/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/231/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/111/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/232/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1579/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/112/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/233/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1699/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/113/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/234/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1335/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1698/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/114/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/235/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1334/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1576/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/2302/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/115/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/236/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/116/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/237/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/117/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/118/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/910/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/119/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/912/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/10/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/2307/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/11/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/918/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/12/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/13/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/14/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/15/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/16/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/17/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/18/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1594/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/120/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/121/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1349/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/122/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/243/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/123/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/2/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/124/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/3/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/4/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/125/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/126/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1344/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1465/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1586/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/127/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/6/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/248/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/128/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/249/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1463/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/800/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/9/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/801/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/20/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/21/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1900/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/22/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/23/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/24/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/25/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/26/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/27/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/28/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/29/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/491/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/250/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/130/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/251/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/252/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/132/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/253/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/254/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/255/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/4509/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/256/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1599/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/257/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1477/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/379/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/258/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1476/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/259/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/1475/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/6249/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/6248/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/4502/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/936/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/30/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/2208/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/4506/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/35/cmdlineJump to behavior
          Source: /tmp/vwkjebwi686.elf (PID: 6267)File opened: /proc/6267/cmdlineJump to behavior

          Hooking and other Techniques for Hiding and Protection

          barindex
          Source: /tmp/vwkjebwi686.elf (PID: 6266)File: /tmp/vwkjebwi686.elfJump to behavior

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: vwkjebwi686.elf, type: SAMPLE
          Source: Yara matchFile source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: vwkjebwi686.elf PID: 6265, type: MEMORYSTR
          Source: Yara matchFile source: vwkjebwi686.elf, type: SAMPLE
          Source: Yara matchFile source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: vwkjebwi686.elf PID: 6265, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: vwkjebwi686.elf, type: SAMPLE
          Source: Yara matchFile source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: vwkjebwi686.elf PID: 6265, type: MEMORYSTR
          Source: Yara matchFile source: vwkjebwi686.elf, type: SAMPLE
          Source: Yara matchFile source: 6265.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: vwkjebwi686.elf PID: 6265, type: MEMORYSTR
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information1
          Scripting
          Valid AccountsWindows Management Instrumentation1
          Scripting
          Path Interception1
          File Deletion
          1
          OS Credential Dumping
          System Service DiscoveryRemote ServicesData from Local System1
          Encrypted Channel
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Non-Standard Port
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
          Non-Application Layer Protocol
          Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
          Application Layer Protocol
          Traffic DuplicationData Destruction
          No configs have been found
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          SourceDetectionScannerLabelLink
          vwkjebwi686.elf100%AviraEXP/ELF.Mirai.Z.A
          vwkjebwi686.elf100%Joe Sandbox ML
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          NameIPActiveMaliciousAntivirus DetectionReputation
          raw.eye-network.ru
          213.232.235.18
          truetrue
            unknown
            raw.eye-network.ru. [malformed]
            unknown
            unknowntrue
              unknown
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              213.232.235.18
              raw.eye-network.ruRussian Federation
              39824ALMANET-ASKZtrue
              109.202.202.202
              unknownSwitzerland
              13030INIT7CHfalse
              91.189.91.43
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              91.189.91.42
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              213.232.235.18dvwkja7.elfGet hashmaliciousMirai, OkiruBrowse
                wheiuwa4.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                  qkbfi86.elfGet hashmaliciousMirai, OkiruBrowse
                    vsbeps.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                      qkbfi86.elfGet hashmaliciousMiraiBrowse
                        vsbeps.elfGet hashmaliciousMiraiBrowse
                          109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                          • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                          91.189.91.43arm7.elfGet hashmaliciousUnknownBrowse
                            mpsl.elfGet hashmaliciousUnknownBrowse
                              ppc.elfGet hashmaliciousUnknownBrowse
                                mozi.m.elfGet hashmaliciousUnknownBrowse
                                  tftp.elfGet hashmaliciousUnknownBrowse
                                    .i.elfGet hashmaliciousUnknownBrowse
                                      i486.elfGet hashmaliciousUnknownBrowse
                                        boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                          nsharm6.elfGet hashmaliciousMiraiBrowse
                                            boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                              91.189.91.42arm7.elfGet hashmaliciousUnknownBrowse
                                                mpsl.elfGet hashmaliciousUnknownBrowse
                                                  ppc.elfGet hashmaliciousUnknownBrowse
                                                    mozi.m.elfGet hashmaliciousUnknownBrowse
                                                      tftp.elfGet hashmaliciousUnknownBrowse
                                                        .i.elfGet hashmaliciousUnknownBrowse
                                                          i486.elfGet hashmaliciousUnknownBrowse
                                                            boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                              nsharm6.elfGet hashmaliciousMiraiBrowse
                                                                boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  raw.eye-network.ruvsbeps.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                                                  • 213.232.235.18
                                                                  vsbeps.elfGet hashmaliciousMiraiBrowse
                                                                  • 213.232.235.18
                                                                  mhmdm9Hb6i.elfGet hashmaliciousMiraiBrowse
                                                                  • 213.130.144.69
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  CANONICAL-ASGBarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  mpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  ppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  mozi.m.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  tftp.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  .i.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  i686.elfGet hashmaliciousUnknownBrowse
                                                                  • 185.125.190.26
                                                                  x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                  • 185.125.190.26
                                                                  i486.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                                  • 91.189.91.42
                                                                  CANONICAL-ASGBarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  mpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  ppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  mozi.m.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  tftp.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  .i.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  i686.elfGet hashmaliciousUnknownBrowse
                                                                  • 185.125.190.26
                                                                  x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                  • 185.125.190.26
                                                                  i486.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                                  • 91.189.91.42
                                                                  ALMANET-ASKZdvwkja7.elfGet hashmaliciousMirai, OkiruBrowse
                                                                  • 213.232.235.18
                                                                  wheiuwa4.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                                                  • 213.232.235.18
                                                                  qkbfi86.elfGet hashmaliciousMirai, OkiruBrowse
                                                                  • 213.232.235.18
                                                                  vsbeps.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                                                  • 213.232.235.18
                                                                  qkbfi86.elfGet hashmaliciousMiraiBrowse
                                                                  • 213.232.235.18
                                                                  vsbeps.elfGet hashmaliciousMiraiBrowse
                                                                  • 213.232.235.18
                                                                  192.142.103.80-x86-2024-08-09T11_47_41.elfGet hashmaliciousUnknownBrowse
                                                                  • 185.102.119.37
                                                                  WE4VRokml7.elfGet hashmaliciousMirai, MoobotBrowse
                                                                  • 185.100.226.244
                                                                  SecuriteInfo.com.Trojan.DownLoader46.58639.512.14557.exeGet hashmaliciousPureLog StealerBrowse
                                                                  • 213.232.235.96
                                                                  INIT7CHarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  mpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  ppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  mozi.m.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  tftp.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  .i.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  i486.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                                  • 109.202.202.202
                                                                  nsharm6.elfGet hashmaliciousMiraiBrowse
                                                                  • 109.202.202.202
                                                                  boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                  • 109.202.202.202
                                                                  No context
                                                                  No context
                                                                  No created / dropped files found
                                                                  File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
                                                                  Entropy (8bit):5.770865465340361
                                                                  TrID:
                                                                  • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                                                  • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                                                  File name:vwkjebwi686.elf
                                                                  File size:105'832 bytes
                                                                  MD5:27003f9fb179560f2e11332739d43e99
                                                                  SHA1:c3931743b3e3519b3a0791990179475592340ddd
                                                                  SHA256:98ece0b04ea95bccb968941630f024879207d8e9d4cb4491211ed6d3104c95eb
                                                                  SHA512:2835f8e51a72503cf79b5e5193854a6f707e3596095c24e893246509b08a18c40438fb679f17c9042d460b664344ffb9dc2a40394eb471a7d2def6d11b3d654e
                                                                  SSDEEP:1536:wRIKmlINCBZNjhju7+B0BVaBg32beHbXWiKlWcOAgJ31Vxvr:weKmqNCZdy7tVaBg32SqFlWcOAQr
                                                                  TLSH:6CA349C0F547C1F6D483493101AAF73FDE31D4694071DA6EEF69AF36EA27882920A65C
                                                                  File Content Preview:.ELF....................h...4...........4. ...(......................S...S...............S...........G..............Q.td............................U..S.......3c...h.....*..[]...$.............U......=.+...t..1...................u........t...$............+

                                                                  ELF header

                                                                  Class:ELF32
                                                                  Data:2's complement, little endian
                                                                  Version:1 (current)
                                                                  Machine:Intel 80386
                                                                  Version Number:0x1
                                                                  Type:EXEC (Executable file)
                                                                  OS/ABI:UNIX - System V
                                                                  ABI Version:0
                                                                  Entry Point Address:0x8048168
                                                                  Flags:0x0
                                                                  ELF Header Size:52
                                                                  Program Header Offset:52
                                                                  Program Header Size:32
                                                                  Number of Program Headers:3
                                                                  Section Header Offset:105432
                                                                  Section Header Size:40
                                                                  Number of Section Headers:10
                                                                  Header String Table Index:9
                                                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                  NULL0x00x00x00x00x0000
                                                                  .initPROGBITS0x80480940x940x1c0x00x6AX001
                                                                  .textPROGBITS0x80480b00xb00x12ae10x00x6AX0016
                                                                  .finiPROGBITS0x805ab910x12b910x170x00x6AX001
                                                                  .rodataPROGBITS0x805abc00x12bc00x27f30x00x2A0032
                                                                  .ctorsPROGBITS0x805e3b80x153b80xc0x00x3WA004
                                                                  .dtorsPROGBITS0x805e3c40x153c40x80x00x3WA004
                                                                  .dataPROGBITS0x805e3e00x153e00x47b80x00x3WA0032
                                                                  .bssNOBITS0x8062ba00x19b980x49ec0x00x3WA0032
                                                                  .shstrtabSTRTAB0x00x19b980x3e0x00x0001
                                                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                  LOAD0x00x80480000x80480000x153b30x153b36.47950x5R E0x1000.init .text .fini .rodata
                                                                  LOAD0x153b80x805e3b80x805e3b80x47e00x91d40.41910x6RW 0x1000.ctors .dtors .data .bss
                                                                  GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Oct 24, 2024 15:42:04.086604118 CEST43928443192.168.2.2391.189.91.42
                                                                  Oct 24, 2024 15:42:05.544476986 CEST5902033966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:05.549870014 CEST3396659020213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:05.549931049 CEST5902033966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:05.549952030 CEST5902033966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:05.555236101 CEST3396659020213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:05.555290937 CEST5902033966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:05.560868979 CEST3396659020213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:06.646291018 CEST4251680192.168.2.23109.202.202.202
                                                                  Oct 24, 2024 15:42:09.717804909 CEST42836443192.168.2.2391.189.91.43
                                                                  Oct 24, 2024 15:42:24.307833910 CEST43928443192.168.2.2391.189.91.42
                                                                  Oct 24, 2024 15:42:25.361548901 CEST3396659020213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:25.361689091 CEST5902033966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:25.367089033 CEST3396659020213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:26.511265993 CEST5902233966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:26.518426895 CEST3396659022213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:26.518558979 CEST5902233966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:26.518558979 CEST5902233966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:26.523930073 CEST3396659022213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:26.524022102 CEST5902233966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:26.532761097 CEST3396659022213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:27.419969082 CEST3396659022213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:27.420130968 CEST5902233966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:27.420180082 CEST5902233966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:27.492925882 CEST5902433966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:27.498282909 CEST3396659024213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:27.498337984 CEST5902433966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:27.498363018 CEST5902433966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:27.503990889 CEST3396659024213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:27.504034996 CEST5902433966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:27.509497881 CEST3396659024213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:28.383930922 CEST3396659024213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:28.384063959 CEST5902433966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:28.384063959 CEST5902433966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:28.462004900 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:28.467633009 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:28.467690945 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:28.467715979 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:28.473167896 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:28.473229885 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:42:28.478650093 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:42:36.594084978 CEST4251680192.168.2.23109.202.202.202
                                                                  Oct 24, 2024 15:42:36.594109058 CEST42836443192.168.2.2391.189.91.43
                                                                  Oct 24, 2024 15:43:05.262276888 CEST43928443192.168.2.2391.189.91.42
                                                                  Oct 24, 2024 15:43:28.507014036 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:28.512722969 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:43:38.513530970 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:38.519241095 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:43:52.052391052 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:43:52.052793026 CEST5902633966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:52.058316946 CEST3396659026213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:43:53.133949995 CEST5902833966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:53.140069008 CEST3396659028213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:43:53.140152931 CEST5902833966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:53.140208960 CEST5902833966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:53.146203041 CEST3396659028213.232.235.18192.168.2.23
                                                                  Oct 24, 2024 15:43:53.146275997 CEST5902833966192.168.2.23213.232.235.18
                                                                  Oct 24, 2024 15:43:53.152270079 CEST3396659028213.232.235.18192.168.2.23
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Oct 24, 2024 15:42:05.497639894 CEST5669153192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:05.508690119 CEST53566918.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:05.508780003 CEST3702453192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:05.515980005 CEST53370248.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:05.516056061 CEST4368653192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:05.523073912 CEST53436868.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:05.523133993 CEST4965253192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:05.530002117 CEST53496528.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:05.530062914 CEST5226453192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:05.537489891 CEST53522648.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:05.537550926 CEST3356953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:05.544410944 CEST53335698.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.363091946 CEST3538653192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.434578896 CEST53353868.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.434743881 CEST5448953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.445259094 CEST53544898.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.445404053 CEST5270753192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.452487946 CEST53527078.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.452580929 CEST3870653192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.461374044 CEST53387068.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.461464882 CEST3664353192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.468734980 CEST53366438.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.468875885 CEST4737153192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.475742102 CEST53473718.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.475831032 CEST4169053192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.483196974 CEST53416908.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.483283997 CEST4934153192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.492512941 CEST53493418.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.492600918 CEST5545453192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.502217054 CEST53554548.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:26.502296925 CEST4830253192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:26.511172056 CEST53483028.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.420289040 CEST5757653192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.428196907 CEST53575768.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.428296089 CEST3381753192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.435921907 CEST53338178.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.436117887 CEST5256953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.443536997 CEST53525698.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.443614960 CEST6034953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.450474977 CEST53603498.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.450546980 CEST5637853192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.457184076 CEST53563788.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.457298994 CEST3993953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.464252949 CEST53399398.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.464339018 CEST4440053192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.471676111 CEST53444008.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.471745968 CEST5183653192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.478800058 CEST53518368.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.478871107 CEST3740153192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.485830069 CEST53374018.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:27.485903025 CEST3419053192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:27.492854118 CEST53341908.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.384218931 CEST4344953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.391105890 CEST53434498.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.391385078 CEST4501753192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.398694992 CEST53450178.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.398890018 CEST6099853192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.405899048 CEST53609988.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.406142950 CEST4967253192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.414158106 CEST53496728.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.414246082 CEST3595953192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.423661947 CEST53359598.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.423875093 CEST4471453192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.432977915 CEST53447148.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.433064938 CEST5400853192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.440138102 CEST53540088.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.440205097 CEST3622053192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.447581053 CEST53362208.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.447645903 CEST4628053192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.454968929 CEST53462808.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:42:28.455034018 CEST5899753192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:42:28.461882114 CEST53589978.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.055133104 CEST3557853192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.062809944 CEST53355788.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.062969923 CEST4846753192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.070493937 CEST53484678.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.070620060 CEST3879253192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.080923080 CEST53387928.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.081156015 CEST3929453192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.088239908 CEST53392948.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.088345051 CEST4780753192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.095776081 CEST53478078.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.095882893 CEST4722453192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.102754116 CEST53472248.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.102864981 CEST4249153192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.110608101 CEST53424918.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.110704899 CEST6022153192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.118431091 CEST53602218.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.118532896 CEST4836553192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.126080036 CEST53483658.8.8.8192.168.2.23
                                                                  Oct 24, 2024 15:43:53.126177073 CEST5947553192.168.2.238.8.8.8
                                                                  Oct 24, 2024 15:43:53.133824110 CEST53594758.8.8.8192.168.2.23
                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Oct 24, 2024 15:42:05.497639894 CEST192.168.2.238.8.8.80xb1f7Standard query (0)raw.eye-network.ruA (IP address)IN (0x0001)false
                                                                  Oct 24, 2024 15:42:05.508780003 CEST192.168.2.238.8.8.80x3a1Standard query (0)raw.eye-network.ru. [malformed]256429false
                                                                  Oct 24, 2024 15:42:05.516056061 CEST192.168.2.238.8.8.80x3a1Standard query (0)raw.eye-network.ru. [malformed]256429false
                                                                  Oct 24, 2024 15:42:05.523133993 CEST192.168.2.238.8.8.80x3a1Standard query (0)raw.eye-network.ru. [malformed]256429false
                                                                  Oct 24, 2024 15:42:05.530062914 CEST192.168.2.238.8.8.80x3a1Standard query (0)raw.eye-network.ru. [malformed]256429false
                                                                  Oct 24, 2024 15:42:05.537550926 CEST192.168.2.238.8.8.80x3a1Standard query (0)raw.eye-network.ru. [malformed]256429false
                                                                  Oct 24, 2024 15:42:26.468875885 CEST192.168.2.238.8.8.80x633fStandard query (0)raw.eye-network.ru. [malformed]256450false
                                                                  Oct 24, 2024 15:42:26.475831032 CEST192.168.2.238.8.8.80x633fStandard query (0)raw.eye-network.ru. [malformed]256450false
                                                                  Oct 24, 2024 15:42:26.483283997 CEST192.168.2.238.8.8.80x633fStandard query (0)raw.eye-network.ru. [malformed]256450false
                                                                  Oct 24, 2024 15:42:26.492600918 CEST192.168.2.238.8.8.80x633fStandard query (0)raw.eye-network.ru. [malformed]256450false
                                                                  Oct 24, 2024 15:42:26.502296925 CEST192.168.2.238.8.8.80x633fStandard query (0)raw.eye-network.ru. [malformed]256450false
                                                                  Oct 24, 2024 15:42:27.457298994 CEST192.168.2.238.8.8.80xa0ecStandard query (0)raw.eye-network.ru. [malformed]256451false
                                                                  Oct 24, 2024 15:42:27.464339018 CEST192.168.2.238.8.8.80xa0ecStandard query (0)raw.eye-network.ru. [malformed]256451false
                                                                  Oct 24, 2024 15:42:27.471745968 CEST192.168.2.238.8.8.80xa0ecStandard query (0)raw.eye-network.ru. [malformed]256451false
                                                                  Oct 24, 2024 15:42:27.478871107 CEST192.168.2.238.8.8.80xa0ecStandard query (0)raw.eye-network.ru. [malformed]256451false
                                                                  Oct 24, 2024 15:42:27.485903025 CEST192.168.2.238.8.8.80xa0ecStandard query (0)raw.eye-network.ru. [malformed]256451false
                                                                  Oct 24, 2024 15:42:28.423875093 CEST192.168.2.238.8.8.80x7015Standard query (0)raw.eye-network.ru. [malformed]256452false
                                                                  Oct 24, 2024 15:42:28.433064938 CEST192.168.2.238.8.8.80x7015Standard query (0)raw.eye-network.ru. [malformed]256452false
                                                                  Oct 24, 2024 15:42:28.440205097 CEST192.168.2.238.8.8.80x7015Standard query (0)raw.eye-network.ru. [malformed]256452false
                                                                  Oct 24, 2024 15:42:28.447645903 CEST192.168.2.238.8.8.80x7015Standard query (0)raw.eye-network.ru. [malformed]256452false
                                                                  Oct 24, 2024 15:42:28.455034018 CEST192.168.2.238.8.8.80x7015Standard query (0)raw.eye-network.ru. [malformed]256452false
                                                                  Oct 24, 2024 15:43:53.095882893 CEST192.168.2.238.8.8.80x33c2Standard query (0)raw.eye-network.ru. [malformed]256281false
                                                                  Oct 24, 2024 15:43:53.102864981 CEST192.168.2.238.8.8.80x33c2Standard query (0)raw.eye-network.ru. [malformed]256281false
                                                                  Oct 24, 2024 15:43:53.110704899 CEST192.168.2.238.8.8.80x33c2Standard query (0)raw.eye-network.ru. [malformed]256281false
                                                                  Oct 24, 2024 15:43:53.118532896 CEST192.168.2.238.8.8.80x33c2Standard query (0)raw.eye-network.ru. [malformed]256281false
                                                                  Oct 24, 2024 15:43:53.126177073 CEST192.168.2.238.8.8.80x33c2Standard query (0)raw.eye-network.ru. [malformed]256281false
                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Oct 24, 2024 15:42:05.508690119 CEST8.8.8.8192.168.2.230xb1f7No error (0)raw.eye-network.ru213.232.235.18A (IP address)IN (0x0001)false

                                                                  System Behavior

                                                                  Start time (UTC):13:42:04
                                                                  Start date (UTC):24/10/2024
                                                                  Path:/tmp/vwkjebwi686.elf
                                                                  Arguments:/tmp/vwkjebwi686.elf
                                                                  File size:105832 bytes
                                                                  MD5 hash:27003f9fb179560f2e11332739d43e99

                                                                  Start time (UTC):13:42:04
                                                                  Start date (UTC):24/10/2024
                                                                  Path:/tmp/vwkjebwi686.elf
                                                                  Arguments:-
                                                                  File size:105832 bytes
                                                                  MD5 hash:27003f9fb179560f2e11332739d43e99

                                                                  Start time (UTC):13:42:04
                                                                  Start date (UTC):24/10/2024
                                                                  Path:/tmp/vwkjebwi686.elf
                                                                  Arguments:-
                                                                  File size:105832 bytes
                                                                  MD5 hash:27003f9fb179560f2e11332739d43e99