Edit tour

Linux Analysis Report
Satan.x86.elf

Overview

General Information

Sample name:	Satan.x86.elf
Analysis ID:	1561573
MD5:	54306a728b30e2b126f15055f93b57d2
SHA1:	445ab03657be811352559beb40e9ec7855156578
SHA256:	9f901cf65b38126d27660797903d8095539a454280cd5464f00a2f6fede4b383
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561573
Start date and time:	2024-11-23 20:27:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Satan.x86.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: Satan.x86.elf

Runtime Messages

Command:	/tmp/Satan.x86.elf
PID:	6219
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Satan.x86.elf (PID: 6219, Parent: 6138, MD5: 54306a728b30e2b126f15055f93b57d2) Arguments: /tmp/Satan.x86.elf

Satan.x86.elf New Fork (PID: 6220, Parent: 6219)

Satan.x86.elf New Fork (PID: 6221, Parent: 6220)

Satan.x86.elf New Fork (PID: 6222, Parent: 6220)

Satan.x86.elf New Fork (PID: 6225, Parent: 6219)

Satan.x86.elf New Fork (PID: 6226, Parent: 6219)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1090c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1095c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f6b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7756:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7082:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6219.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1090c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1095c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6219.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f6b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6219.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7756:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6219.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7082:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6220.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1090c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1095c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6220.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f6b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6220.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7756:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6220.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7082:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6225.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1090c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1095c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6225.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f6b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6225.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7756:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6225.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7082:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Satan.x86.elf PID: 6219	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.x86.elf PID: 6220	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x641:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.x86.elf PID: 6221	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1107:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1143:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1157:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1193:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1233:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1247:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1283:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Satan.x86.elf PID: 6225	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x641:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Satan.x86.elf

ReversingLabs: Detection: 44%

Machine Learning detection for sample

Source: Satan.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:38364 -> 193.84.71.119:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.71.119

Source: Satan.x86.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Satan.x86.elf PID: 6219, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.x86.elf PID: 6220, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.x86.elf PID: 6221, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Satan.x86.elf PID: 6225, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6219.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6220.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Satan.x86.elf PID: 6219, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.x86.elf PID: 6220, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.x86.elf PID: 6221, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Satan.x86.elf PID: 6225, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/141/status	Jump to behavior
Source: /tmp/Satan.x86.elf (PID: 6219)	File opened: /proc/262/status	Jump to behavior

Source: Satan.x86.elf

Submission file: segment LOAD with 7.9638 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Satan.x86.elf	45%	ReversingLabs	Linux.Backdoor.Mirai
Satan.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Satan.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
193.84.71.119	unknown	Poland	199478	RADIOCABLE-ASES	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
193.84.71.119	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse
	Satan.arm.elf	Get hash	malicious	Mirai	Browse
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	Satan.i686.elf	Get hash	malicious	Unknown	Browse
	Satan.mpsl.elf	Get hash	malicious	Unknown	Browse
	Satan.arm.elf	Get hash	malicious	Mirai	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	Satan.m68k.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse
	Satan.arm.elf	Get hash	malicious	Mirai	Browse
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse
	Satan.arm.elf	Get hash	malicious	Mirai	Browse
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RADIOCABLE-ASES	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.i686.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.mpsl.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	193.84.71.119
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
	Satan.m68k.elf	Get hash	malicious	Mirai	Browse	193.84.71.119
CANONICAL-ASGB	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	Satan.x86_64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Satan.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Satan.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Satan.sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.961900134204177
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Satan.x86.elf
File size:	38'756 bytes
MD5:	54306a728b30e2b126f15055f93b57d2
SHA1:	445ab03657be811352559beb40e9ec7855156578
SHA256:	9f901cf65b38126d27660797903d8095539a454280cd5464f00a2f6fede4b383
SHA512:	1f95b5d2db7ecb7f069805cd340d56dc878646fd20bd74c090e61b4f6d87209d3a86798164b7564fecce6284f76e14d1613917762cd488890143a5c9fbd7526e
SSDEEP:	768:d6o76s6sXiWoa2NNeDfv83JcXOx6yaA11kuK5npy5mvvI+fnbcuyD7UrQRjs:M+6TmiWUuD852G1z1GfyYRnouy8ryI
TLSH:	E103F1A19BFBCF2CC19CA13C06BBF16B0241905B554DC0A62D4876A988C7F29B9587E3
File Content Preview:	.ELF....................x...4...........4. ...(.....................l...l...........................................Q.td.............................-..UPX!.........2...2......W..........?..k.I/.j....\.R......)..n.4go.\|.>#.....{~q..`.mm.XCp.ch....i.E'.)..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc09478
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x966c	0x966c	7.9638	0x5	R E	0x1000
LOAD	0xc08	0x805bc08	0x805bc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 20:27:44.963581085 CET	38364	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:45.084428072 CET	3778	38364	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:45.084517956 CET	38364	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:45.084546089 CET	38364	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:45.204557896 CET	3778	38364	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:45.204632044 CET	38364	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:45.329308033 CET	3778	38364	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:46.182940006 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:27:47.454967022 CET	3778	38364	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:47.455120087 CET	38364	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:47.581928968 CET	3778	38364	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:48.455888033 CET	38366	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:48.575972080 CET	3778	38366	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:48.576092005 CET	38366	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:48.576092958 CET	38366	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:48.696187973 CET	3778	38366	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:48.696330070 CET	38366	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:48.816029072 CET	3778	38366	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:50.339540005 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:50.459494114 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:50.459589005 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:50.459779024 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:50.580779076 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:50.580940008 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:50.703697920 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:50.902153969 CET	3778	38366	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:50.902376890 CET	38366	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:51.023302078 CET	3778	38366	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:51.558144093 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 20:27:51.903775930 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:52.028429031 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:52.028532028 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:52.028590918 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:52.152735949 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:52.152904034 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:52.272793055 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:52.839535952 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:52.839869976 CET	38368	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:52.962109089 CET	3778	38368	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:53.093986988 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 20:27:53.840930939 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:53.960655928 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:53.960762978 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:53.960804939 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:54.084242105 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:54.084383965 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:54.210701942 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:54.355242014 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:54.355391979 CET	38370	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:54.481791019 CET	3778	38370	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:55.356558084 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:55.477756977 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:55.477890968 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:55.478123903 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:55.603837013 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:55.604022026 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:55.730547905 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:56.292732954 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:56.292934895 CET	38372	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:56.419629097 CET	3778	38372	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:57.294291019 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:57.415307045 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:57.415482044 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:57.415606976 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:57.536001921 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:57.536166906 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:57.659015894 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:57.777277946 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:57.777499914 CET	38374	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:57.904021978 CET	3778	38374	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:58.778537035 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:58.898494959 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:58.898634911 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:58.898689032 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:59.021226883 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:59.021323919 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:59.146226883 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:59.786566973 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:27:59.786742926 CET	38376	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:27:59.907908916 CET	3778	38376	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:00.788575888 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:00.908580065 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:00.908731937 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:00.908832073 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:01.035149097 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:01.035314083 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:01.161945105 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:01.242731094 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:01.242971897 CET	38378	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:01.362705946 CET	3778	38378	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:02.244633913 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:02.371301889 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:02.371541023 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:02.371666908 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:02.498131990 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:02.498313904 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:02.617966890 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:03.277010918 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:03.277242899 CET	38380	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:03.396931887 CET	3778	38380	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:04.278700113 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:04.405385971 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:04.405572891 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:04.405683041 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:04.531549931 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:04.531790018 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:04.654109001 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:04.755518913 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:04.755712986 CET	38382	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:04.880213022 CET	3778	38382	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:05.757297039 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:05.880084038 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:05.880208969 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:05.880558014 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:06.001712084 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:06.001981020 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:06.123253107 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:06.148119926 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:28:06.739732027 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:06.740361929 CET	38384	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:06.864500046 CET	3778	38384	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:07.741911888 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:07.861850977 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:07.862137079 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:07.862283945 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:07.982215881 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:07.982410908 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:08.102407932 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:08.214736938 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:08.215306997 CET	38386	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:08.340879917 CET	3778	38386	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:09.217123032 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:09.339217901 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:09.339634895 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:09.339771986 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:09.461613894 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:09.461812019 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:09.584440947 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:10.206060886 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:10.206398964 CET	38388	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:10.332938910 CET	3778	38388	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:11.207739115 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:11.327613115 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:11.327925920 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:11.328000069 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:11.451184034 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:11.451483965 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:11.576874971 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:11.668447971 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:11.668750048 CET	38390	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:11.792057991 CET	3778	38390	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:12.670034885 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:12.789975882 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:12.790100098 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:12.790185928 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:12.910072088 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:12.910227060 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:13.037866116 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:13.693027973 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:13.693449020 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.051044941 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.079174042 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:14.079303026 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.169694901 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:14.173816919 CET	3778	38392	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:14.173979044 CET	38392	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.695208073 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.815023899 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:14.815293074 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.815424919 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:14.940572023 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:14.940881014 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:15.067430019 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:15.074567080 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:15.074752092 CET	38394	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:15.201158047 CET	3778	38394	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:16.075913906 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:16.200644016 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:16.201006889 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:16.201006889 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:16.320780039 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:16.320986986 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:16.446353912 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:17.146271944 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:17.146457911 CET	38396	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:17.266109943 CET	3778	38396	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:18.147545099 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:18.434377909 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 20:28:18.568015099 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:18.568283081 CET	38398	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:18.807351112 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:18.807374954 CET	3778	38398	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:18.807511091 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:18.807579041 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:18.928407907 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:18.928484917 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:19.055058002 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:19.569749117 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:19.690073013 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:19.690218925 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:19.690299988 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:19.815259933 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:19.815397024 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:19.941884995 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:21.137098074 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:21.137325048 CET	38400	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:21.258001089 CET	3778	38400	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:22.021436930 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:22.021676064 CET	38402	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:22.139208078 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:22.142693996 CET	3778	38402	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:22.259346008 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:22.259604931 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:22.259665966 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:22.386399031 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:22.386588097 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:22.513144970 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:22.529726982 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 20:28:23.023221970 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:23.145081043 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:23.145389080 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:23.145389080 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:23.268943071 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:23.269100904 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:23.394113064 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:24.606131077 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:24.606431961 CET	38404	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:24.726322889 CET	3778	38404	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:25.552656889 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:25.552886963 CET	38406	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:25.608167887 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:25.675338984 CET	3778	38406	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:25.728497028 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:25.728677034 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:25.728739977 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:25.848534107 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:25.848679066 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:25.971349001 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:26.554806948 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:26.674616098 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:26.674773932 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:26.674957037 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:26.795816898 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:26.796020985 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:26.922506094 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:28.052656889 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:28.052876949 CET	38408	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:28.173263073 CET	3778	38408	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:29.053045988 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:29.053561926 CET	38410	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:29.054683924 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:29.174421072 CET	3778	38410	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:29.175600052 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:29.175909042 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:29.175909996 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:29.302541018 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:29.302889109 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:29.428937912 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:30.055032969 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:30.174936056 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:30.175247908 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:30.175390959 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:30.295077085 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:30.295249939 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:30.414880037 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:31.571203947 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:31.571502924 CET	38412	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:31.695455074 CET	3778	38412	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:32.465663910 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:32.465831995 CET	38414	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:32.572983027 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:32.586796045 CET	3778	38414	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:32.694331884 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:32.694422960 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:32.694461107 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:33.152271986 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:33.396534920 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:33.396625042 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:33.467077017 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:33.593918085 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:33.593997002 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:33.594043970 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:33.717966080 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:33.718055010 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:33.838231087 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:35.068697929 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:35.068789959 CET	38416	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:35.195411921 CET	3778	38416	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:35.927699089 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:35.927874088 CET	38418	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:36.048955917 CET	3778	38418	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:36.069947958 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:36.191453934 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:36.191694975 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:36.191695929 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:36.639794111 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:36.880855083 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:36.880894899 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:36.929332018 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:37.055943012 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:37.056019068 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:37.056062937 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:37.182871103 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:37.183084011 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:37.302784920 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:38.535815001 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:38.535969019 CET	38420	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:38.659190893 CET	3778	38420	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:39.402981997 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:39.403126955 CET	38422	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:39.529690981 CET	3778	38422	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:39.537360907 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:39.661500931 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:39.661705017 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:39.661705017 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:39.781917095 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:39.781992912 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:39.901799917 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:40.404568911 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:40.529911041 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:40.529988050 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:40.530042887 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:40.649983883 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:40.650163889 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:40.771361113 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:42.022049904 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:42.022212982 CET	38424	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:42.142043114 CET	3778	38424	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:42.881150007 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:42.881278038 CET	38426	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:43.007847071 CET	3778	38426	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:43.023484945 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:43.147260904 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:43.147341967 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:43.147375107 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:43.267045021 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:43.267164946 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:43.387370110 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:43.882713079 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:44.002881050 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:44.002955914 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:44.002980947 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:44.122637033 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:44.122709036 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:44.243350029 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:45.469122887 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:45.469254017 CET	38428	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:45.590712070 CET	3778	38428	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:46.340675116 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:46.340826988 CET	38430	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:46.460721016 CET	3778	38430	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:46.470530987 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:46.593137980 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:46.593410969 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:46.593410969 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:46.717346907 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:46.717483044 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:46.842777967 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:47.102345943 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 20:28:47.342397928 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:47.468311071 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:47.468625069 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:47.468625069 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:47.588267088 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:47.588488102 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:47.711874008 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:48.927881956 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:48.928191900 CET	38432	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:49.047768116 CET	3778	38432	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:49.850122929 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:49.850259066 CET	38434	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:49.929779053 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:49.973171949 CET	3778	38434	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:50.049401999 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:50.049485922 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:50.049534082 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:50.169110060 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:50.169287920 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:50.289082050 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:50.851304054 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:50.977924109 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:50.978049040 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:50.978102922 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:51.103985071 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:51.104165077 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:51.223926067 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:52.474992037 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:52.475362062 CET	38436	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:52.597137928 CET	3778	38436	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:53.293886900 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:53.294034958 CET	38438	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:53.418361902 CET	3778	38438	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:53.476983070 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:53.603568077 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:53.603672981 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:53.603672981 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:53.725261927 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:53.725333929 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:53.845175982 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:54.295346022 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:54.415117025 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:54.415406942 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:54.415407896 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:54.535770893 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:54.535872936 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:54.663418055 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:55.991007090 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:55.991302967 CET	38440	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:56.111094952 CET	3778	38440	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:56.740572929 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:56.740945101 CET	38442	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:56.860878944 CET	3778	38442	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:56.993577957 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.115964890 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:57.116097927 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.116184950 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.242444038 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:57.242542028 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.366446018 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:57.743130922 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.867171049 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:57.867307901 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.867428064 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:57.990705013 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:57.990825891 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:58.110781908 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:59.490693092 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:28:59.491049051 CET	38444	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:28:59.610951900 CET	3778	38444	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:00.169377089 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:00.169533014 CET	38446	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:00.296423912 CET	3778	38446	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:00.493549109 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:00.613763094 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:00.613886118 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:00.613975048 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:00.733774900 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:00.734040976 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:00.858246088 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:01.171685934 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:01.291734934 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:01.291870117 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:01.291994095 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:01.412755013 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:01.412969112 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:01.539674044 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:02.975482941 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:02.975730896 CET	38448	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:03.099610090 CET	3778	38448	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:03.662695885 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:03.662862062 CET	38450	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:03.787841082 CET	3778	38450	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:03.977355957 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.098678112 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:04.098763943 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.098815918 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.218619108 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:04.218862057 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.338768959 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:04.665093899 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.789810896 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:04.790071011 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.790172100 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:04.910242081 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:04.910370111 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:05.307780027 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:05.367275000 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:05.428289890 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:06.467494011 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:06.467794895 CET	38452	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:06.594464064 CET	3778	38452	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:07.107012033 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:07.107275009 CET	38454	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:07.229880095 CET	3778	38454	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:07.469553947 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:07.594810963 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:07.595115900 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:07.595226049 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:07.720901012 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:07.721013069 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:07.847588062 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:08.109260082 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:08.229990959 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:08.230297089 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:08.230535984 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:08.357611895 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:08.357953072 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:08.484498024 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:09.891168118 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:09.891458035 CET	38456	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:10.016227007 CET	3778	38456	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:10.528373003 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:10.528609991 CET	38458	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:10.648530006 CET	3778	38458	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:10.893296957 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:11.017183065 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:11.017280102 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:11.017324924 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:11.143156052 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:11.143255949 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:11.266621113 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:11.530204058 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:11.990947008 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:11.991200924 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:11.991202116 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:12.111156940 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:12.111385107 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:12.235148907 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:13.388015032 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:13.388425112 CET	38460	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:13.508192062 CET	3778	38460	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:14.278711081 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:14.278898001 CET	38462	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:14.390144110 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:14.401041031 CET	3778	38462	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:14.510473967 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:14.510603905 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:14.510689020 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:14.630575895 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:14.630636930 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:14.750438929 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:15.280600071 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:15.405208111 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:15.405296087 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:15.405383110 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:15.531784058 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:15.531857967 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:15.656037092 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:16.912889957 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:16.913074970 CET	38464	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:17.033124924 CET	3778	38464	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:17.741034031 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:17.741183043 CET	38466	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:17.861537933 CET	3778	38466	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:17.914563894 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.039258957 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:18.039422035 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.039478064 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.165895939 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:18.166059971 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.289439917 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:18.742894888 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.862843037 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:18.863028049 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.863079071 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:18.983119965 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:18.983258963 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:19.103513956 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:20.419697046 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:20.419946909 CET	38468	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:20.542707920 CET	3778	38468	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:21.185427904 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:21.185714960 CET	38470	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:21.305972099 CET	3778	38470	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:21.422055960 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:21.548583031 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:21.548763037 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:21.548841000 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:22.009541035 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:22.187979937 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:22.253351927 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:22.253469944 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:22.379231930 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:22.379537106 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:22.379664898 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:22.506129026 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:22.506398916 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:22.628006935 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:23.903753042 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:23.904027939 CET	38472	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:24.030592918 CET	3778	38472	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:24.737843990 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:24.738178968 CET	38474	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:24.862009048 CET	3778	38474	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:24.906054020 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.025749922 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:25.025887966 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.025969982 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.145517111 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:25.145628929 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.268456936 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:25.740169048 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.860408068 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:25.860553980 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.860666037 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:25.980983019 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:25.981276989 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:26.102314949 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:27.413378000 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:27.413845062 CET	38476	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:27.533509016 CET	3778	38476	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:28.194499016 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:28.195122957 CET	38478	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:28.320403099 CET	3778	38478	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:28.416114092 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:28.542388916 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:28.542646885 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:28.542762041 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:28.662339926 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:28.662496090 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:28.782269955 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:29.197314024 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:29.324403048 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:29.324542046 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:29.324682951 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:29.451523066 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:29.451778889 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:29.573853970 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:30.953201056 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:30.953572989 CET	38480	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:31.075278997 CET	3778	38480	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:31.710453987 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:31.710711002 CET	38482	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:31.830391884 CET	3778	38482	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:31.955589056 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.076441050 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:32.076698065 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.076798916 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.198780060 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:32.199054003 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.324942112 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:32.713000059 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.834120989 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:32.834279060 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.834408045 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:32.959553003 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:32.959716082 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:33.086325884 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:34.374319077 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:34.374502897 CET	38484	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:34.499278069 CET	3778	38484	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:35.226402044 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:35.226620913 CET	38486	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:35.352164030 CET	3778	38486	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:35.375902891 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:35.497849941 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:35.497932911 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:35.497981071 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:35.618084908 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:35.618156910 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:35.739072084 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:36.228046894 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:36.348269939 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:36.348404884 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:36.348499060 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:36.474994898 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:36.475132942 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:36.601665020 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:37.829853058 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:37.830094099 CET	38488	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:37.950823069 CET	3778	38488	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:38.685496092 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:38.685705900 CET	38490	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:38.805437088 CET	3778	38490	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:38.831778049 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:38.952430010 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:38.952593088 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:38.952697992 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:39.072597027 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:39.072700024 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:39.192439079 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:39.687449932 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:39.808044910 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:39.808217049 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:39.808352947 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:39.931653976 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:39.931912899 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:40.057136059 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:41.288472891 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:41.288912058 CET	38492	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:41.415124893 CET	3778	38492	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:42.107573032 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:42.107883930 CET	38494	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:42.227541924 CET	3778	38494	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:42.290690899 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:42.412487030 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:42.412743092 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:42.412955046 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:42.534040928 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:42.534212112 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:42.660789013 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:43.109778881 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:43.229938984 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:43.230103016 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:43.230204105 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:43.351389885 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:43.351613045 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:43.472984076 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:44.773540020 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:44.774003029 CET	38496	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:44.893768072 CET	3778	38496	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:45.535653114 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:45.535939932 CET	38498	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:45.659836054 CET	3778	38498	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:45.775701046 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:45.901830912 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:45.902007103 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:45.902117014 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:46.023905039 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:46.024178028 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:46.144188881 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:46.537749052 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:46.663274050 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:46.663403988 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:46.663649082 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:46.785887957 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:46.786056995 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:46.905787945 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:48.232496977 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:48.232927084 CET	38500	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:48.356048107 CET	3778	38500	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:48.991592884 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:48.991931915 CET	38502	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:49.112159014 CET	3778	38502	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:49.234752893 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:49.356676102 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:49.356786013 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:49.356894016 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:49.483261108 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:49.483377934 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:49.606488943 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:49.993093967 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:50.119848967 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:50.119946957 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:50.120182991 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:50.245184898 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:50.245277882 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:50.364844084 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:51.685736895 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:51.686103106 CET	38504	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:51.811599016 CET	3778	38504	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:52.421921015 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:52.422327042 CET	38506	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:52.547350883 CET	3778	38506	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:52.687899113 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:52.807744980 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:52.807856083 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:52.807993889 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:52.928780079 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:52.928884029 CET	38508	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:53.052795887 CET	3778	38508	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:53.424021006 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:53.544004917 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:53.544094086 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:53.544195890 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:53.664067984 CET	3778	38510	193.84.71.119	192.168.2.23
Nov 23, 2024 20:29:53.664155960 CET	38510	3778	192.168.2.23	193.84.71.119
Nov 23, 2024 20:29:53.787437916 CET	3778	38510	193.84.71.119	192.168.2.23

System Behavior

Analysis Process: Satan.x86.elf PID: 6219, Parent PID: 6138

General

Start time (UTC):	19:27:43
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.x86.elf
Arguments:	/tmp/Satan.x86.elf
File size:	38756 bytes
MD5 hash:	54306a728b30e2b126f15055f93b57d2

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6220, Parent PID: 6219

General

Start time (UTC):	19:27:43
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.x86.elf
Arguments:	-
File size:	38756 bytes
MD5 hash:	54306a728b30e2b126f15055f93b57d2

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6221, Parent PID: 6220

General

Start time (UTC):	19:27:43
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.x86.elf
Arguments:	-
File size:	38756 bytes
MD5 hash:	54306a728b30e2b126f15055f93b57d2

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6222, Parent PID: 6220

General

Start time (UTC):	19:27:43
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.x86.elf
Arguments:	-
File size:	38756 bytes
MD5 hash:	54306a728b30e2b126f15055f93b57d2

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6225, Parent PID: 6219

General

Start time (UTC):	19:27:49
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.x86.elf
Arguments:	-
File size:	38756 bytes
MD5 hash:	54306a728b30e2b126f15055f93b57d2

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6226, Parent PID: 6219

General

Start time (UTC):	19:27:49
Start date (UTC):	23/11/2024
Path:	/tmp/Satan.x86.elf
Arguments:	-
File size:	38756 bytes
MD5 hash:	54306a728b30e2b126f15055f93b57d2

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Satan.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Satan.x86.elf PID: 6219, Parent PID: 6138

General

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6220, Parent PID: 6219

General

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6221, Parent PID: 6220

General

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6222, Parent PID: 6220

General

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6225, Parent PID: 6219

General

Chronological Activities

Analysis Process: Satan.x86.elf PID: 6226, Parent PID: 6219

General

Chronological Activities

Linux Analysis Report
Satan.x86.elf