Edit tour

Linux Analysis Report
Satan.arm7.elf

Overview

General Information

Sample name:	Satan.arm7.elf
Analysis ID:	1561569
MD5:	26244c3ab68f37450765d949f5224e3f
SHA1:	49bdc89c4fbb2a708581c6bfb9d243f87f3a1ef2
SHA256:	7dd48ee3c78c19eadd688198321c42ceab0f2af5f24b3e45ca21cc2c57567beb
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561569
Start date and time:	2024-11-23 20:07:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Satan.arm7.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: Satan.arm7.elf

Runtime Messages

Command:	/tmp/Satan.arm7.elf
PID:	6234
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Satan.arm7.elf (PID: 6234, Parent: 6159, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Satan.arm7.elf

Satan.arm7.elf New Fork (PID: 6236, Parent: 6234)

Satan.arm7.elf New Fork (PID: 6238, Parent: 6236)

Satan.arm7.elf New Fork (PID: 6240, Parent: 6236)

Satan.arm7.elf New Fork (PID: 6244, Parent: 6234)

Satan.arm7.elf New Fork (PID: 6246, Parent: 6234)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6236.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6236.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1545c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1554c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1559c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6234.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6234.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1545c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1554c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1559c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6238.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1545c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1554c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1559c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6244.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6244.1.00007f83f4017000.00007f83f402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1545c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1554c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1559c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm7.elf PID: 6234	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm7.elf PID: 6234	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12599:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12611:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12625:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12639:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1264d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12661:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12675:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12689:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1269d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12701:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12715:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12729:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm7.elf PID: 6236	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm7.elf PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x82d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x841:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x855:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x869:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x87d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x891:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x909:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x931:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x945:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x959:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x96d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x981:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x995:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm7.elf PID: 6238	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm7.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfbc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm7.elf PID: 6244	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm7.elf PID: 6244	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4bca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ca6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ce2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cf6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Satan.arm7.elf

ReversingLabs: Detection: 34%

Source: global traffic

TCP traffic: 192.168.2.23:38368 -> 193.84.71.119:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119

Source: Satan.arm7.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6236.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6234.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6244.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm7.elf PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm7.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm7.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm7.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 6236.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6234.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6244.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm7.elf PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm7.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm7.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm7.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/6234/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/6240/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/4502/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/Satan.arm7.elf (PID: 6234)	File opened: /proc/260/status	Jump to behavior

Source: Satan.arm7.elf

Submission file: segment LOAD with 7.9733 entropy (max. 8.0)

Source: /tmp/Satan.arm7.elf (PID: 6234)

Queries kernel information via 'uname':

Jump to behavior

Source: Satan.arm7.elf, 6234.1.000055e41f906000.000055e41fb54000.rw-.sdmp, Satan.arm7.elf, 6236.1.000055e41f906000.000055e41fb34000.rw-.sdmp, Satan.arm7.elf, 6238.1.000055e41f906000.000055e41fb34000.rw-.sdmp, Satan.arm7.elf, 6244.1.000055e41f906000.000055e41fb54000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Satan.arm7.elf, 6234.1.000055e41f906000.000055e41fb54000.rw-.sdmp, Satan.arm7.elf, 6236.1.000055e41f906000.000055e41fb34000.rw-.sdmp, Satan.arm7.elf, 6238.1.000055e41f906000.000055e41fb34000.rw-.sdmp, Satan.arm7.elf, 6244.1.000055e41f906000.000055e41fb54000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Satan.arm7.elf, 6234.1.00007ffc91342000.00007ffc91363000.rw-.sdmp, Satan.arm7.elf, 6236.1.00007ffc91342000.00007ffc91363000.rw-.sdmp, Satan.arm7.elf, 6238.1.00007ffc91342000.00007ffc91363000.rw-.sdmp, Satan.arm7.elf, 6244.1.00007ffc91342000.00007ffc91363000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Satan.arm7.elf, 6234.1.00007ffc91342000.00007ffc91363000.rw-.sdmp, Satan.arm7.elf, 6236.1.00007ffc91342000.00007ffc91363000.rw-.sdmp, Satan.arm7.elf, 6238.1.00007ffc91342000.00007ffc91363000.rw-.sdmp, Satan.arm7.elf, 6244.1.00007ffc91342000.00007ffc91363000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Satan.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Satan.arm7.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6236.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6234, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6244, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6236.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.00007f83f4017000.00007f83f402f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6234, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm7.elf PID: 6244, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Satan.arm7.elf	34%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Satan.arm7.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
193.84.71.119	unknown	Poland	199478	RADIOCABLE-ASES	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
193.84.71.119	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	Satan.i686.elf	Get hash	malicious	Unknown	Browse
	Satan.mpsl.elf	Get hash	malicious	Unknown	Browse
	Satan.arm.elf	Get hash	malicious	Mirai	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	Satan.m68k.elf	Get hash	malicious	Mirai	Browse
	Satan.ppc.elf	Get hash	malicious	Unknown	Browse
	Satan.mips.elf	Get hash	malicious	Unknown	Browse
	Satan.arm6.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	.i.elf	Get hash	malicious	Unknown	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sora.arm6.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	.i.elf	Get hash	malicious	Unknown	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sora.arm6.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RADIOCABLE-ASES	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.i686.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.mpsl.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.m68k.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.ppc.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.mips.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm6.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
CANONICAL-ASGB	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.983252812525424
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Satan.arm7.elf
File size:	61'828 bytes
MD5:	26244c3ab68f37450765d949f5224e3f
SHA1:	49bdc89c4fbb2a708581c6bfb9d243f87f3a1ef2
SHA256:	7dd48ee3c78c19eadd688198321c42ceab0f2af5f24b3e45ca21cc2c57567beb
SHA512:	fccb71c39cdfab38d55fed2f67b68bb13947d4d81dcb51eb5d01d383f70e2061195142980752e9d596989176b686e4de5d23152c41e02e0e3d653da5ace7dd3b
SSDEEP:	1536:eyiqybiQVcnlJIrjhTjFV22QLvCXNv3k6nvrVBaEbA7:ef+GhT5LQL4Nc6vrVZbA7
TLSH:	5A5312B657A22FBAD8F0D0B33A2F06C153776DBCF311A031187AF9189DA4B2009B9547
File Content Preview:	.ELF..............(.....p...4...........4. ...(.....................]...]................6...6...6..................Q.td...............................OUPX!........#o..#o......j..........?.E.h;....#..$...o...S.#H.i.....-....i0a....+$.P.=....._H..n.b...#d.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11c70
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xae5d	0xae5d	7.9733	0x5	R E	0x8000
LOAD	0x36c8	0x236c8	0x236c8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 20:07:48.267028093 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:48.394068003 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:48.394292116 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:48.396934032 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:48.517098904 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:48.517173052 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:48.637937069 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:50.485464096 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:07:50.714221001 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:50.714526892 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:50.841226101 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:51.716237068 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:51.836210966 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:51.836424112 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:51.837176085 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:51.956931114 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:51.957102060 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:52.081578016 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:53.741478920 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:53.861386061 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:53.861468077 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:53.864717960 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:54.127538919 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:54.127693892 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:54.260916948 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:54.484873056 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:54.494868040 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:54.495839119 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:54.500315905 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:54.500345945 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:54.500374079 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:54.619698048 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:54.619791031 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:55.129549026 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:55.253968954 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:55.254169941 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:55.255023003 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:55.378954887 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:55.379139900 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:55.501451969 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:55.860707998 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 20:07:56.199007034 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:56.199482918 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:56.326077938 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:57.201131105 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:57.327842951 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:57.327931881 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:57.329106092 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:57.396615028 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 20:07:57.455590963 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:57.455737114 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:57.575558901 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:57.652133942 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:57.652316093 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:57.775122881 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:58.653345108 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:58.778918028 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:58.779007912 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:58.779894114 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:58.904898882 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:58.904983997 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:59.024683952 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:59.699213982 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:07:59.699559927 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:07:59.820633888 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:00.701443911 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:00.826617002 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:00.826703072 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:00.827598095 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:00.949445963 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:00.949553967 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:01.070105076 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:01.139158964 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:01.139410973 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:01.265150070 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:02.140973091 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:02.260905027 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:02.261003971 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:02.262336016 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:02.382000923 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:02.382113934 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:02.501903057 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:03.158483982 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:03.158809900 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:03.278438091 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:04.160939932 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:04.280653954 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:04.281073093 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:04.282157898 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:04.401774883 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:04.402141094 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:04.521893024 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:04.549521923 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:04.549839020 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:04.669512033 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:05.551708937 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:05.671494007 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:05.671658993 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:05.672656059 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:05.792234898 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:05.792484999 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:05.913731098 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:06.580943108 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:06.581231117 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:06.704154015 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:07.583132029 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:07.702987909 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:07.703125000 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:07.704108953 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:07.830177069 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:07.830452919 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:07.953325033 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:07.997769117 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:07.998163939 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:08.120893955 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:08.999687910 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:09.120801926 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:09.124438047 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:09.125336885 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:09.245213032 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:09.245317936 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:09.368274927 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:10.074382067 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:10.074624062 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:10.196787119 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:11.076836109 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:11.196577072 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:11.196818113 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:11.197875023 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:11.323086023 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:11.323620081 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:11.449218035 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:11.449281931 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:11.449552059 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:11.569240093 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:11.986571074 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:08:12.451509953 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:12.577846050 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:12.578154087 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:12.579217911 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:12.700629950 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:12.700954914 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:12.820884943 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:13.512939930 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:13.513470888 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:13.633856058 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:14.515755892 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:14.635586023 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:14.635778904 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:14.636998892 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:14.762535095 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:14.762660980 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:14.888730049 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:14.980431080 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:14.980775118 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:15.106223106 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:15.982485056 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:16.105568886 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:16.105731964 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:16.106786966 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:16.227624893 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:16.227852106 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:16.354415894 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:17.058931112 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:17.059168100 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:17.179420948 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:18.060957909 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:18.184782982 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:18.184899092 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:18.186219931 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:18.306775093 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:18.307178974 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:18.429406881 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:18.465100050 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:18.465395927 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:18.588038921 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:19.466928005 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:19.590277910 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:19.590635061 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:19.591772079 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:19.712235928 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:19.712398052 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:19.834558010 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:20.499126911 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:20.499391079 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:20.621932030 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:21.501252890 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:21.621329069 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:21.621468067 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:21.622776031 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:21.744007111 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:21.744462967 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:21.869153976 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:21.970798969 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:21.971029043 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:22.092628002 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:22.225127935 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 20:08:22.973268032 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:23.093154907 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:23.093415976 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:23.094686985 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:23.214224100 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:23.214632034 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:23.334839106 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:23.980942965 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:23.981106043 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:24.105567932 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:24.983021975 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:25.102813959 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:25.102919102 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:25.103682995 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:25.226821899 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:25.226927996 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:25.353373051 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:25.418148041 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:25.418308973 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:25.537959099 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:26.419841051 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:26.541430950 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:26.541521072 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:26.542593956 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:26.662286043 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:26.662385941 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:26.782991886 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:27.434138060 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:27.434319019 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:27.560637951 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:28.368247032 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 20:08:28.435925007 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:28.558259010 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:28.558346033 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:28.559473991 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:28.685327053 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:28.685458899 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:28.807591915 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:28.843281031 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:28.843381882 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:28.963207006 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:29.844835043 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:29.964581013 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:29.964678049 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:29.965930939 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:30.085468054 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:30.085549116 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:30.207473993 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:30.893982887 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:30.894108057 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:31.018399000 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:31.895701885 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:32.020148039 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:32.020446062 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:32.021558046 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:32.146126032 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:32.146248102 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:32.266242027 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:32.340322018 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:32.340449095 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:32.460227966 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:33.342484951 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:33.463499069 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:33.463762045 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:33.464703083 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:33.584456921 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:33.584703922 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:33.705452919 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:34.355938911 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:34.356297016 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:34.482697964 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:35.358119011 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:35.478234053 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:35.478420973 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:35.479794025 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:35.604816914 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:35.605046034 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:35.726541996 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:35.794003963 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:35.794401884 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:35.918440104 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:36.796747923 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:36.917639971 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:36.917776108 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:36.919207096 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:37.042820930 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:37.043041945 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:37.169450998 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:37.793476105 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:37.793734074 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:37.913975954 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:38.795835018 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:38.916404963 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:38.916543007 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:38.917808056 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:39.038311005 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:39.038567066 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:39.158341885 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:39.253192902 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:39.253706932 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:39.373895884 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:40.256011963 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:40.378297091 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:40.378571033 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:40.380099058 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:40.501230955 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:40.501338959 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:40.622690916 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:41.344975948 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:41.345415115 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:41.468535900 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:42.348102093 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:42.471518040 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:42.471683025 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:42.473099947 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:42.592870951 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:42.593084097 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:42.706361055 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:42.706573009 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:42.712841034 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:42.826370001 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:43.708349943 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:43.830773115 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:43.830960989 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:43.832448006 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:43.952527046 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:43.952728033 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:44.072475910 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:44.824868917 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:44.825130939 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:44.948894024 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:45.827028036 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:45.953511953 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:45.953627110 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:45.954685926 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:46.080703974 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:46.080817938 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:46.128351927 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:46.128521919 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:46.200414896 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:46.248327017 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:47.130163908 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:47.249958038 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:47.250047922 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:47.251141071 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:47.371484041 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:47.371567965 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:47.495364904 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:48.340641975 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:48.341034889 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:48.462483883 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:49.342880964 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:49.468120098 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:49.468235016 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:49.469232082 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:49.581428051 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:49.581619024 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:49.589627981 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:49.589698076 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:49.701864958 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:49.710216045 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:50.583038092 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:50.703255892 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:50.703407049 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:50.704533100 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:50.827385902 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:50.827537060 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:50.947362900 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:51.831418991 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:51.831829071 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:51.951881886 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:52.834372044 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:52.940877914 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:08:52.957789898 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:52.958023071 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:52.959635973 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:53.003103971 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:53.003309965 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:53.081991911 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:53.082211971 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:53.123502016 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:53.202053070 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:54.005584955 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:54.131719112 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:54.131912947 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:54.133439064 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:54.254808903 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:54.255064011 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:54.374674082 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:55.331554890 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:55.331954002 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:55.451699972 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:56.334506989 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:56.454267979 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:56.454557896 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:56.456132889 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:56.466160059 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:56.466304064 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:56.575669050 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:56.575911999 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:56.585870028 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:56.695492029 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:57.469023943 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:57.590101957 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:57.590257883 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:57.592075109 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:57.711636066 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:57.711790085 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:57.831370115 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:58.739027977 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:58.739201069 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:58.858772039 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:59.741374969 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:59.861181021 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:59.861457109 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:59.862852097 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:59.919687986 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:59.919862032 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:59.919929981 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:08:59.982502937 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:08:59.982708931 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:00.040244102 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:00.102555037 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:00.922121048 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:01.048724890 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:01.048876047 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:01.049990892 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:01.175206900 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:01.175493956 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:01.295449972 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:02.192445993 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:02.192812920 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:02.313035965 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:03.195072889 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:03.314987898 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:03.315130949 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:03.316768885 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:03.359653950 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:03.359926939 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:03.437011957 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:03.437117100 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:03.479557037 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:03.556719065 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:04.362998009 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:04.482773066 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:04.482887030 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:04.484703064 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:04.604279995 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:04.604408026 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:04.724069118 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:05.600936890 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:05.601221085 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:05.727725983 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:06.604013920 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:06.725096941 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:06.725357056 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:06.726994038 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:06.816605091 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:06.816941977 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:06.847178936 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:06.847246885 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:06.937580109 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:06.966859102 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:07.819473982 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:07.939790010 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:07.939924002 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:07.941330910 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:08.060904026 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:08.061048985 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:08.181292057 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:09.091298103 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:09.091480970 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:09.211076021 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:10.093688011 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:10.216505051 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:10.216589928 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:10.217791080 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:10.309705019 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:10.309968948 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:10.340678930 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:10.340747118 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:10.434026003 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:10.465130091 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:11.312005043 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:11.436491013 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:11.436671972 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:11.437947989 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:11.557473898 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:11.557589054 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:11.677139044 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:12.544725895 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:12.544982910 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:12.665105104 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:13.547698021 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:13.670855999 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:13.670938969 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:13.672651052 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:13.785419941 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:13.785624981 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:13.792205095 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:13.792263031 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:13.905273914 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:13.911916018 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:14.788187027 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:14.907840014 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:14.908134937 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:14.909632921 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:15.029381990 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:15.029479027 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:15.149085999 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:15.997450113 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:15.997673988 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:15.997767925 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:16.119749069 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:17.000951052 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:17.122598886 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:17.122749090 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:17.125075102 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:17.245769978 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:17.245990038 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:17.285368919 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:17.285733938 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:17.370099068 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:17.412226915 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:18.288392067 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:18.415462971 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:18.415703058 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:18.417428017 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:18.537194014 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:18.537421942 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:18.657562971 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:19.482201099 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:19.482537031 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:19.602269888 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:20.485718012 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:20.609324932 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:20.609637976 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:20.611386061 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:20.731236935 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:20.731328964 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:20.769542933 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:20.769640923 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:20.850862980 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:20.889569044 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:21.772463083 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:21.892784119 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:21.893028021 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:21.894742966 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:22.014920950 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:22.015172005 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:22.137607098 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:22.943270922 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:22.943458080 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:23.070149899 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:23.946074009 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:24.070089102 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:24.070240021 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:24.072133064 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:24.198561907 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:24.198719978 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:24.294945002 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:24.295177937 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:24.320751905 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:24.414833069 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:25.297626019 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:25.421084881 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:25.421222925 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:25.422746897 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:25.547657013 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:25.547898054 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:25.674160957 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:26.426002026 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:26.426400900 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:26.546200037 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:27.429079056 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:27.549535990 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:27.549638033 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:27.551279068 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:27.670876026 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:27.670973063 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:27.790590048 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:27.794460058 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:27.794646978 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:27.916954994 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:28.796741962 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:28.917175055 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:28.917329073 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:28.918772936 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:29.038366079 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:29.038439989 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:29.161887884 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:29.832746983 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:29.833234072 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:29.952800989 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:30.835736990 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:30.962243080 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:30.962316036 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:30.963752031 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:31.088038921 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:31.088119030 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:31.207664013 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:31.238511086 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:31.238863945 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:31.358417034 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:32.241940022 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:32.366628885 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:32.366720915 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:32.367882967 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:32.488814116 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:32.488915920 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:32.608855009 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:33.325992107 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:33.326410055 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:33.447185040 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:34.329097033 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:34.455874920 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:34.455950975 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:34.457472086 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:34.583518982 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:34.583587885 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:34.708961964 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:34.716671944 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:34.717046022 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:34.836774111 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:35.719527006 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:35.839273930 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:35.839426994 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:35.840415955 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:35.962595940 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:35.962716103 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:36.089391947 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:36.794857025 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:36.795217037 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:36.918807030 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:37.798161030 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:37.919110060 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:37.919301033 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:37.921149015 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:38.040813923 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:38.041016102 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:38.163002014 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:38.169881105 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:38.170053005 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:38.296523094 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:39.173074007 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:39.292943001 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:39.293108940 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:39.294559002 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:39.414048910 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:39.414216995 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:39.533941984 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:40.225605011 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:40.225863934 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:40.352294922 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:41.228262901 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:41.353416920 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:41.353529930 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:41.354614019 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:41.478272915 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:41.478416920 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:41.598218918 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:41.629290104 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:41.629591942 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:41.749609947 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:42.632160902 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:42.755610943 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:42.755867958 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:42.757327080 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:42.883507013 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:42.883667946 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:43.009840965 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:43.701050043 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:43.701261044 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:43.827456951 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:44.704063892 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:44.829911947 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:44.830063105 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:44.831923962 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:44.955243111 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:44.955379963 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:45.075128078 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:45.140814066 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:45.141056061 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:45.260808945 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:46.143831968 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:46.267005920 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:46.267126083 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:46.269052029 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:46.394834042 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:46.394918919 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:46.518707037 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:47.263617039 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:47.263880968 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:47.383608103 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:48.266922951 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:48.386940956 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:48.387098074 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:48.388999939 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:48.568130970 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:48.568357944 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:48.671053886 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:48.671164989 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:48.790452003 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:48.790669918 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:49.571146011 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:49.694720984 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:49.694845915 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:49.696790934 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:49.819142103 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:49.819259882 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:49.945003033 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:50.848208904 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:50.848475933 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:50.968106985 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:51.851583958 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:51.971668005 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:51.971959114 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:51.973817110 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:52.004547119 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:52.004755974 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:52.094722033 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:52.094866037 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:52.124875069 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:52.214598894 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:53.007441044 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:53.127496958 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:53.127652884 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:53.128880024 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:53.254165888 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:53.254403114 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:53.380438089 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:54.370862007 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:54.371118069 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:54.491341114 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:55.373428106 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:55.466862917 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:55.467044115 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:55.493138075 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:55.493251085 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:55.494448900 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:55.590321064 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:55.619803905 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:55.619977951 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:55.739551067 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:56.469222069 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:56.589180946 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:56.589354992 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:56.590796947 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:56.710417032 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:56.710575104 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:56.830768108 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:57.973664045 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:09:57.973907948 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:09:58.098378897 CET	3778	38512	193.84.71.119	192.168.2.23

System Behavior

Analysis Process: Satan.arm7.elf PID: 6234, Parent PID: 6159

General

Start time (UTC):	19:07:47
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm7.elf
Arguments:	/tmp/Satan.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6236, Parent PID: 6234

General

Start time (UTC):	19:07:47
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6238, Parent PID: 6236

General

Start time (UTC):	19:07:47
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6240, Parent PID: 6236

General

Start time (UTC):	19:07:47
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6244, Parent PID: 6234

General

Start time (UTC):	19:07:52
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6246, Parent PID: 6234

General

Start time (UTC):	19:07:52
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Satan.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Satan.arm7.elf PID: 6234, Parent PID: 6159

General

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6236, Parent PID: 6234

General

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6238, Parent PID: 6236

General

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6240, Parent PID: 6236

General

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6244, Parent PID: 6234

General

Chronological Activities

Analysis Process: Satan.arm7.elf PID: 6246, Parent PID: 6234

General

Chronological Activities

Linux Analysis Report
Satan.arm7.elf