Edit tour

Linux Analysis Report
Satan.arm.elf

Overview

General Information

Sample name:	Satan.arm.elf
Analysis ID:	1561570
MD5:	c6a8c79e2ebbc90f4cf47f4810daadd3
SHA1:	093908067e7d575412aca9eb3f34c1ce4320715c
SHA256:	acef8177afcd54f929fc30ce23f884dc92855db67aa693392049082fc055047e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561570
Start date and time:	2024-11-23 20:17:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Satan.arm.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: Satan.arm.elf

Runtime Messages

Command:	/tmp/Satan.arm.elf
PID:	6241
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Satan.arm.elf (PID: 6241, Parent: 6164, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Satan.arm.elf

Satan.arm.elf New Fork (PID: 6244, Parent: 6241)

Satan.arm.elf New Fork (PID: 6246, Parent: 6244)

Satan.arm.elf New Fork (PID: 6247, Parent: 6244)

Satan.arm.elf New Fork (PID: 6256, Parent: 6241)

Satan.arm.elf New Fork (PID: 6258, Parent: 6241)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6244.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6244.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1202c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6241.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6241.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1202c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6246.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6246.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1202c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6256.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6256.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1202c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm.elf PID: 6241	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm.elf PID: 6241	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm.elf PID: 6244	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm.elf PID: 6244	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2f83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fe7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ffb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x300f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3023:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3037:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x304b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x305f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3073:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3087:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x309b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3113:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm.elf PID: 6246	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm.elf PID: 6246	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.arm.elf PID: 6256	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Satan.arm.elf PID: 6256	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a03c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Satan.arm.elf

ReversingLabs: Detection: 31%

Source: global traffic

TCP traffic: 192.168.2.23:38368 -> 193.84.71.119:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119

Source: Satan.arm.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6244.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6246.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6256.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm.elf PID: 6246, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.arm.elf PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 6244.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6246.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6256.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm.elf PID: 6246, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.arm.elf PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/6226/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/6241/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/6247/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/Satan.arm.elf (PID: 6241)	File opened: /proc/260/status	Jump to behavior

Source: Satan.arm.elf

Submission file: segment LOAD with 7.9706 entropy (max. 8.0)

Source: /tmp/Satan.arm.elf (PID: 6241)

Queries kernel information via 'uname':

Jump to behavior

Source: Satan.arm.elf, 6241.1.0000558660423000.00005586605d5000.rw-.sdmp, Satan.arm.elf, 6244.1.0000558660423000.00005586605b1000.rw-.sdmp, Satan.arm.elf, 6246.1.0000558660423000.00005586605b1000.rw-.sdmp, Satan.arm.elf, 6256.1.0000558660423000.00005586605d5000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Satan.arm.elf, 6241.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp, Satan.arm.elf, 6244.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp, Satan.arm.elf, 6246.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp, Satan.arm.elf, 6256.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Satan.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Satan.arm.elf
Source: Satan.arm.elf, 6241.1.0000558660423000.00005586605d5000.rw-.sdmp, Satan.arm.elf, 6244.1.0000558660423000.00005586605b1000.rw-.sdmp, Satan.arm.elf, 6246.1.0000558660423000.00005586605b1000.rw-.sdmp, Satan.arm.elf, 6256.1.0000558660423000.00005586605d5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Satan.arm.elf, 6241.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp, Satan.arm.elf, 6244.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp, Satan.arm.elf, 6246.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp, Satan.arm.elf, 6256.1.00007ffe71bff000.00007ffe71c20000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6244.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6241, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6256, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6244.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f4cc4017000.00007f4cc402c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6241, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Satan.arm.elf PID: 6256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Satan.arm.elf	32%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Satan.arm.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
193.84.71.119	unknown	Poland	199478	RADIOCABLE-ASES	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
193.84.71.119	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	Satan.i686.elf	Get hash	malicious	Unknown	Browse
	Satan.mpsl.elf	Get hash	malicious	Unknown	Browse
	Satan.arm.elf	Get hash	malicious	Mirai	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	Satan.m68k.elf	Get hash	malicious	Mirai	Browse
	Satan.ppc.elf	Get hash	malicious	Unknown	Browse
	Satan.mips.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sora.arm6.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sora.arm6.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RADIOCABLE-ASES	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.i686.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.mpsl.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.m68k.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.ppc.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.mips.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
CANONICAL-ASGB	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.9686465084272315
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Satan.arm.elf
File size:	39'312 bytes
MD5:	c6a8c79e2ebbc90f4cf47f4810daadd3
SHA1:	093908067e7d575412aca9eb3f34c1ce4320715c
SHA256:	acef8177afcd54f929fc30ce23f884dc92855db67aa693392049082fc055047e
SHA512:	2c71a52a9a7968137143f4e9f404542a7aa6f107d431f186a442b1ab515222cce69c12bfdb5f4b0ab7252e1cf9880f73ae479d6e5f00699b11f653eaae73b949
SSDEEP:	768:2ufHR8HXrbu1pVi1lCIxeP7v4AAZPbfbW7eH+pFs3UozNW:BHSbbu1pVKC6ez4tdbf67bIzNW
TLSH:	F803E171218A0DB5C0B01D7BAF7E8DC39782A5F4E1BD32E4362163DEAC650D6223E5E1
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................o...o................{...{...{..................Q.td............................s.y.UPX!.........T...T......T..........?.E.h;.}...^..........fK..z..,vU...].XLU../..7J....}8......S<b.<_..Y

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x106c0
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x986f	0x986f	7.9706	0x5	R E	0x8000
LOAD	0x7bc8	0x27bc8	0x27bc8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 20:17:50.380412102 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:50.503556013 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:50.503667116 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:50.533852100 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:50.655755043 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:50.655806065 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:50.779406071 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:50.953353882 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:17:52.815749884 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:52.816466093 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:52.936253071 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:53.818026066 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:53.942547083 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:53.942797899 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:53.943701982 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:54.068043947 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:54.068109035 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:54.188724041 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:56.059286118 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:56.182159901 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:56.182231903 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:56.192738056 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:56.234607935 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:56.234709978 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:56.318042040 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:56.318099976 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:56.361088991 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:56.440123081 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:56.584656000 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 20:17:57.236507893 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:57.357799053 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:57.358026981 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:57.358979940 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:57.482126951 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:57.482198954 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:57.608762026 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:58.120450020 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 20:17:58.565287113 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:58.565943956 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:58.685575008 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:59.567336082 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:59.687120914 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:59.687225103 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:59.688117981 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:59.702300072 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:59.702435970 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:59.810774088 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:59.810895920 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:17:59.824884892 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:17:59.932538986 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:00.704018116 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:00.823858976 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:00.823947906 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:00.824800968 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:00.950545073 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:00.950630903 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:01.077261925 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:02.089823961 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:02.090014935 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:02.209654093 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:03.091408014 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:03.140201092 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:03.140443087 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:03.211771965 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:03.211951017 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:03.212781906 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:03.262753963 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:03.339086056 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:03.339308023 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:03.464606047 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:04.142047882 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:04.263159990 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:04.263261080 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:04.264322042 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:04.383842945 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:04.384001017 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:04.504475117 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:05.556626081 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:05.557488918 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:05.678193092 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:06.560036898 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:06.649427891 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:06.649624109 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:06.680434942 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:06.680713892 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:06.681978941 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:06.770298958 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:06.801599979 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:06.801798105 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:06.922715902 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:07.651490927 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:07.778141022 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:07.778471947 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:07.779453993 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:07.899041891 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:07.899292946 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:08.018898010 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:09.009160995 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:09.009785891 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:09.132807970 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:10.011771917 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:10.098290920 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:10.098617077 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:10.134772062 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:10.134994030 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:10.136024952 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:10.220689058 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:10.256738901 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:10.256841898 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:10.378545046 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:11.100480080 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:11.227247000 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:11.227601051 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:11.229224920 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:11.355565071 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:11.355689049 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:11.477406025 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:12.421720028 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:12.422213078 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:12.542746067 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:12.710498095 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:18:13.425465107 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:13.551964045 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:13.552288055 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:13.553695917 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:13.602544069 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:13.602780104 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:13.679641962 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:13.679872990 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:13.729217052 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:13.804572105 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:14.604640961 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:14.724332094 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:14.724591017 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:14.725770950 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:14.851835012 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:14.852036953 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:14.978308916 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:15.907279968 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:15.907650948 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:16.028034925 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:16.909547091 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:17.035990953 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:17.036071062 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:17.037219048 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:17.134095907 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:17.134305954 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:17.163465977 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:17.163527966 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:17.259088039 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:17.284096956 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:18.136243105 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:18.256002903 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:18.256094933 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:18.257350922 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:18.383404970 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:18.383538961 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:18.509798050 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:19.348647118 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:19.348887920 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:19.474931955 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:20.351217031 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:20.475697041 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:20.475764990 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:20.476860046 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:20.546427965 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:20.546711922 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:20.600629091 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:20.600725889 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:20.669343948 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:20.725523949 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:21.548821926 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:21.668637037 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:21.668710947 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:21.669994116 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:21.789632082 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:21.789836884 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:21.910079002 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:22.837075949 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:22.837481976 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:22.949042082 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 20:18:22.961654902 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:23.839704037 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:23.962896109 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:23.963114023 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:23.964194059 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:24.008786917 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:24.008949041 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:24.083678007 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:24.083801031 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:24.128611088 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:24.204035044 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:25.011032104 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:25.136874914 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:25.137140036 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:25.138206005 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:25.257769108 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:25.257828951 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:25.380160093 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:26.265258074 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:26.265516043 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:26.387454987 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:27.267574072 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:27.391019106 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:27.391202927 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:27.392301083 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:27.421710968 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:27.421886921 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:27.512716055 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:27.512882948 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:27.541594982 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:27.633147955 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:28.423924923 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:28.543586969 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:28.543848038 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:28.545341015 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:28.664911985 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:28.664999962 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:28.786364079 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:29.092080116 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 20:18:29.743731022 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:29.743974924 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:29.863574028 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:30.746239901 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:30.828017950 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:30.828299046 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:30.873559952 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:30.873788118 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:30.875338078 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:30.954829931 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:31.000991106 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:31.001179934 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:31.121354103 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:31.830745935 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:31.951416016 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:31.951649904 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:31.953043938 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:32.073681116 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:32.073900938 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:32.193574905 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:33.227986097 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:33.228259087 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:33.353832006 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:34.231101036 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:34.287451982 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:34.287678957 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:34.356267929 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:34.356426954 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:34.357979059 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:34.414022923 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:34.482311010 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:34.482700109 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:34.607737064 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:35.290209055 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:35.416131973 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:35.416344881 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:35.417674065 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:35.541996002 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:35.542260885 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:35.661930084 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:36.728650093 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:36.729091883 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:36.848792076 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:37.732084990 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:37.743647099 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:37.743829012 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:37.851736069 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:37.852055073 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:37.853758097 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:37.863567114 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:37.974211931 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:37.974502087 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:38.099822044 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:38.746412992 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:38.866095066 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:38.866302013 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:38.868263006 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:38.989773035 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:38.989882946 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:39.111574888 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:40.197140932 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:40.197551966 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:40.321002007 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:41.200488091 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:41.228236914 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:41.228466988 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:41.325443029 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:41.325670004 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:41.327284098 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:41.354856968 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:41.454184055 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:41.454333067 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:41.580657005 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:42.231282949 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:42.351039886 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:42.351253033 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:42.353250980 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:42.472753048 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:42.472915888 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:42.595774889 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:43.640826941 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:43.641069889 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:43.767520905 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:44.644617081 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:44.728120089 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:44.728425026 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:44.771055937 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:44.771264076 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:44.772983074 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:44.854633093 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:44.896889925 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:44.896997929 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:45.016642094 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:45.731081963 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:45.851260900 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:45.851398945 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:45.853050947 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:45.972796917 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:45.973054886 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:46.094643116 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:47.081818104 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:47.082271099 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:47.205429077 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:48.085150003 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:48.172224045 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:48.172589064 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:48.211764097 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:48.211960077 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:48.213455915 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:48.299036980 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:48.339840889 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:48.340079069 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:48.466167927 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:49.175290108 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:49.302160025 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:49.302290916 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:49.303983927 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:49.428241014 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:49.428582907 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:49.548548937 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:50.556385040 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:50.556618929 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:50.681891918 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:51.559783936 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:51.634514093 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:51.634732008 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:51.679459095 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:51.679848909 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:51.681376934 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:51.755239010 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:51.801434994 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:51.801675081 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:51.921786070 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:52.637610912 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:52.758079052 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:52.758193016 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:52.759860992 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:52.879506111 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:52.879743099 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:53.002135038 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:53.664839983 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:18:54.000114918 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:54.000454903 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:54.120101929 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:55.002774954 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:55.119044065 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:55.119340897 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:55.122693062 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:55.125174999 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:55.126877069 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:55.238974094 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:55.246548891 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:55.246603966 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:55.366327047 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:56.123085022 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:56.246208906 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:56.246439934 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:56.248311043 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:56.374603987 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:56.374726057 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:56.500891924 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:57.545943975 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:57.546238899 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:57.669630051 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:58.549236059 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:58.619277000 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:58.619581938 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:58.669764042 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:58.669943094 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:58.671546936 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:58.739159107 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:58.791086912 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:58.791363955 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:58.911773920 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:59.621999025 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:59.743510008 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:18:59.743706942 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:18:59.745327950 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:00.127830029 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:00.240298986 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:00.360012054 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:01.010787964 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:01.011205912 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:01.134027958 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:02.013834953 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:02.140211105 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:02.140373945 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:02.141813993 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:02.266680002 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:02.266928911 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:02.391659975 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:02.453515053 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:02.453859091 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:02.580349922 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:03.456252098 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:03.582726002 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:03.582948923 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:03.584270954 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:03.708020926 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:03.708385944 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:03.828655005 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:04.473113060 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:04.473532915 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:04.593192101 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:05.475887060 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:05.596703053 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:05.596988916 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:05.598365068 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:05.719510078 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:05.719743967 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:05.842026949 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:06.009813070 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:06.010317087 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:06.130970955 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:07.012748957 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:07.134531021 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:07.134716988 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:07.136099100 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:07.255609989 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:07.255867958 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:07.378519058 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:07.971359968 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:07.971657038 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:08.092875004 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:08.973747015 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:09.094463110 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:09.094650030 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:09.095952034 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:09.216535091 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:09.216763020 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:09.338020086 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:09.453632116 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:09.454127073 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:09.580554008 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:10.456314087 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:10.582161903 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:10.582267046 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:10.583328962 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:10.709204912 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:10.709430933 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:10.835624933 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:11.407151937 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:11.407542944 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:11.533855915 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:12.410375118 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:12.535933971 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:12.536263943 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:12.537697077 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:12.658031940 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:12.658154011 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:12.778861046 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:12.969480038 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:12.969744921 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:13.096400976 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:13.971780062 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:14.097430944 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:14.097577095 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:14.098845959 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:14.224363089 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:14.224647999 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:14.350709915 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:15.025437117 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:15.025927067 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:15.145936966 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:16.027606964 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:16.153493881 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:16.153758049 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:16.154817104 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:16.279268026 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:16.279331923 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:16.391511917 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:16.391706944 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:16.405689001 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:16.516799927 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:17.393320084 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:17.519649982 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:17.519819975 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:17.520591974 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:17.645199060 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:17.645260096 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:17.769184113 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:18.525648117 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:18.525912046 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:18.647470951 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:19.527592897 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:19.650448084 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:19.650651932 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:19.651994944 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:19.859961033 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:19.860054016 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:20.061041117 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:20.105700016 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:20.105798006 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:20.224874973 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:20.861989975 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:20.982268095 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:20.982369900 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:20.983376026 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:21.104011059 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:21.104129076 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:21.227546930 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:21.998413086 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:21.998639107 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:22.120136023 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:23.000376940 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:23.120255947 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:23.120342970 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:23.122637033 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:23.242419958 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:23.242496967 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:23.266566038 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:23.266689062 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:23.363954067 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:23.388478994 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:24.268595934 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:24.396589041 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:24.396719933 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:24.398122072 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:24.529745102 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:24.529906034 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:24.656579018 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:25.454404116 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:25.454675913 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:25.580820084 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:26.456682920 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:26.583189964 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:26.583301067 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:26.584811926 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:26.704787970 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:26.704916000 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:26.740489006 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:26.740755081 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:26.824805021 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:26.860675097 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:27.742619991 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:27.862922907 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:27.863096952 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:27.864139080 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:27.983958960 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:27.984097958 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:28.106302977 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:28.875965118 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:28.876219034 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:28.996004105 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:29.877845049 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:29.997755051 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:29.997849941 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:29.998671055 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:30.118161917 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:30.118243933 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:30.229481936 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:30.229604006 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:30.238162041 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:30.356192112 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:31.230891943 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:31.351438046 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:31.351516962 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:31.352355957 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:31.475290060 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:31.475372076 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:31.601813078 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:32.329636097 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:32.329902887 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:32.456310034 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:33.331864119 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:33.455859900 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:33.455946922 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:33.457199097 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:33.583591938 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:33.583681107 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:33.708717108 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:33.713196039 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:33.713375092 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:33.833188057 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:34.714956045 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:34.840215921 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:34.840279102 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:34.841134071 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:34.966126919 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:34.966202974 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:35.086709023 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:35.822824001 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:35.823016882 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:35.946528912 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:36.824634075 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:36.951252937 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:36.951416016 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:36.952178001 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:37.077734947 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:37.077846050 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:37.141678095 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:37.141823053 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:37.197521925 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:37.261688948 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:38.142890930 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:38.267374039 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:38.267491102 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:38.268157959 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:38.392895937 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:38.392972946 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:38.512598991 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:39.291709900 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:39.291893959 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:39.416510105 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:40.293344021 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:40.415049076 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:40.415158987 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:40.415875912 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:40.538233042 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:40.538357973 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:40.614702940 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:40.614830017 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:40.658474922 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:40.737175941 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:41.616338968 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:41.742939949 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:41.743048906 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:41.743937969 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:41.866048098 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:41.866177082 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:41.985852957 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:42.755234957 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:42.755441904 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:42.879553080 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:43.757678032 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:43.877569914 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:43.877734900 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:43.878855944 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:44.002541065 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:44.002655029 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:44.104274988 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:44.104507923 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:44.129045010 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:44.229830027 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:45.106460094 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:45.233145952 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:45.233283997 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:45.234508038 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:45.360420942 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:45.360578060 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:45.480288029 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:46.173222065 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:46.173429966 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:46.173429966 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:46.298053026 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:47.175162077 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:47.295094967 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:47.295222044 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:47.296550989 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:47.416642904 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:47.416708946 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:47.536252022 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:47.551565886 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:47.551678896 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:47.671300888 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:48.553533077 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:48.675271034 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:48.675385952 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:48.676493883 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:48.796396971 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:48.796519041 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:48.916137934 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:49.687551022 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:49.687716007 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:49.808223009 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:50.689676046 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:50.809758902 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:50.809849024 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:50.811014891 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:50.933156013 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:50.933224916 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:51.059798002 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:51.173938990 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:51.174159050 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:51.293987989 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:52.176162004 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:52.296224117 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:52.296369076 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:52.297265053 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:52.417213917 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:52.417304039 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:52.540841103 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:53.292331934 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:53.292795897 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:53.416260958 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:54.295239925 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:54.422056913 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:54.422209978 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:54.423856020 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:54.548805952 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:54.549088001 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:54.667143106 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:54.667581081 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:54.668768883 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:54.787415028 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:55.670188904 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:55.791981936 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:55.792113066 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:55.793004036 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:55.916683912 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:55.916882992 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:56.037370920 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:56.767390013 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:56.767729998 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:56.889802933 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:57.770509005 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:57.896967888 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:57.897102118 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:57.898294926 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:58.024581909 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:58.024821043 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:58.120202065 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:58.120424032 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:58.149981022 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:58.241338015 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:59.126099110 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:59.246109009 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:59.246398926 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:59.247870922 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:59.368196011 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:19:59.368444920 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:19:59.491735935 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:00.260654926 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:00.260927916 CET	38512	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:20:00.387439013 CET	3778	38512	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:01.263331890 CET	38516	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:20:01.385493040 CET	3778	38516	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:01.385636091 CET	38516	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:20:01.386897087 CET	38516	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:20:01.509955883 CET	3778	38516	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:01.510107994 CET	38516	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:20:01.574193001 CET	3778	38514	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:01.574385881 CET	38514	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:20:01.634819984 CET	3778	38516	193.84.71.119	192.168.2.23
Nov 23, 2024 20:20:01.698136091 CET	3778	38514	193.84.71.119	192.168.2.23

System Behavior

Analysis Process: Satan.arm.elf PID: 6241, Parent PID: 6164

General

Start time (UTC):	19:17:49
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm.elf
Arguments:	/tmp/Satan.arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6244, Parent PID: 6241

General

Start time (UTC):	19:17:49
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6246, Parent PID: 6244

General

Start time (UTC):	19:17:49
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6247, Parent PID: 6244

General

Start time (UTC):	19:17:49
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6256, Parent PID: 6241

General

Start time (UTC):	19:17:55
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6258, Parent PID: 6241

General

Start time (UTC):	19:17:55
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Satan.arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Satan.arm.elf PID: 6241, Parent PID: 6164

General

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6244, Parent PID: 6241

General

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6246, Parent PID: 6244

General

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6247, Parent PID: 6244

General

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6256, Parent PID: 6241

General

Chronological Activities

Analysis Process: Satan.arm.elf PID: 6258, Parent PID: 6241

General

Chronological Activities

Linux Analysis Report
Satan.arm.elf