Edit tour

Linux Analysis Report
3M2y5KkOrL.elf

Overview

General Information

Sample name:	3M2y5KkOrL.elf renamed because original name is a hash value
Original sample name:	76049a7d151826aab9677963c6fc4078.elf
Analysis ID:	1428679
MD5:	76049a7d151826aab9677963c6fc4078
SHA1:	23d1b86af70ea679b57f37f8cf0cfd898f0d9e5b
SHA256:	9a25096189da8348242bbbfd61a94d03864abe3b9b85d572f2f6d661a48bfd19
Tags:	32armelfgafgyt
Infos:

Detection

Mirai, Okiru

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428679
Start date and time:	2024-04-19 11:46:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	3M2y5KkOrL.elf renamed because original name is a hash value
Original Sample Name:	76049a7d151826aab9677963c6fc4078.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/1025@135/0

Runtime Messages

Command:	/tmp/3M2y5KkOrL.elf
PID:	5452
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

3M2y5KkOrL.elf (PID: 5452, Parent: 5368, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/3M2y5KkOrL.elf

3M2y5KkOrL.elf New Fork (PID: 5454, Parent: 5452)

3M2y5KkOrL.elf New Fork (PID: 5456, Parent: 5454)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
3M2y5KkOrL.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
3M2y5KkOrL.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
3M2y5KkOrL.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
3M2y5KkOrL.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1886c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1890c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1895c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
3M2y5KkOrL.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1872c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5452.1.00007fad80017000.00007fad80032000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5452.1.00007fad80017000.00007fad80032000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5452.1.00007fad80017000.00007fad80032000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5452.1.00007fad80017000.00007fad80032000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1886c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1890c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1895c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5452.1.00007fad80017000.00007fad80032000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1872c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 3M2y5KkOrL.elf PID: 5452	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 3M2y5KkOrL.elf PID: 5452	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 3M2y5KkOrL.elf PID: 5452	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1062:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1076:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1102:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1116:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1152:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1166:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 3M2y5KkOrL.elf PID: 5452	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 4 entries

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: 3M2y5KkOrL.elf	ReversingLabs: Detection: 55%
Source: 3M2y5KkOrL.elf	Virustotal: Detection: 59%			Perma Link

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: 3M2y5KkOrL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 3M2y5KkOrL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5452.1.00007fad80017000.00007fad80032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5452.1.00007fad80017000.00007fad80032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 3M2y5KkOrL.elf PID: 5452, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 3M2y5KkOrL.elf PID: 5452, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/5392/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/3641/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/5287/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/3M2y5KkOrL.elf (PID: 5456)	File opened: /proc/30/cmdline	Jump to behavior

Source: 3M2y5KkOrL.elf, 5452.1.0000563096b83000.0000563096cd3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 3M2y5KkOrL.elf, 5452.1.0000563096b83000.0000563096cd3000.rw-.sdmp	Binary or memory string: 0V!/etc/qemu-binfmt/arm
Source: 3M2y5KkOrL.elf, 5452.1.00007ffea872f000.00007ffea8750000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: 3M2y5KkOrL.elf, 5452.1.00007ffea872f000.00007ffea8750000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/3M2y5KkOrL.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/3M2y5KkOrL.elf

Source: Yara match	File source: 3M2y5KkOrL.elf, type: SAMPLE
Source: Yara match	File source: 5452.1.00007fad80017000.00007fad80032000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3M2y5KkOrL.elf PID: 5452, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
3M2y5KkOrL.elf	55%	ReversingLabs	Linux.Trojan.Mirai
3M2y5KkOrL.elf	59%	Virustotal		Browse
3M2y5KkOrL.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	qIEANK2huJ.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	NlF293hgXW.elf	Get hash	malicious	Mirai, Okiru	Browse
	PN9QHDmpS1.elf	Get hash	malicious	Mirai, Okiru	Browse
	eGjHpgUwlt.elf	Get hash	malicious	Mirai, Okiru	Browse
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	vlxx.arm7-20240418-1854.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86_64-20240418-1853.elf	Get hash	malicious	Mirai, Okiru	Browse
	G9J8ic1utC.elf	Get hash	malicious	Unknown	Browse
	Ja84Oghm6q.elf	Get hash	malicious	Mirai, Okiru	Browse
	QpHMHEg6OQ.elf	Get hash	malicious	Chaos	Browse

Source: 3M2y5KkOrL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 3M2y5KkOrL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5452.1.00007fad80017000.00007fad80032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5452.1.00007fad80017000.00007fad80032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 3M2y5KkOrL.elf PID: 5452, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 3M2y5KkOrL.elf PID: 5452, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	qbmHR5ZIJL.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	91.189.91.42
	qIEANK2huJ.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	185.125.190.26
	NlF293hgXW.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	FZqYclxRiu.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	PN9QHDmpS1.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	eGjHpgUwlt.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	qlt52dfogC.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	185.125.190.26
	46t2vW6nO9.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	l1uxT537eS.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

Process:	/tmp/3M2y5KkOrL.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgWwcXlGn:TgOXAn
MD5:	EAB90CF1B607E26D3E2F4B05C3F84AA6
SHA1:	0754F5586ED40E5D52DB7A6DE226A537117D72E6
SHA-256:	24D5329AD001106B08656A6DC28AC36FA0CCF90C4715109F750FEC29F1033D2F
SHA-512:	829546FCC6308E8B7784AA748234CBED4F933576F40007998911C22BB2EB51AE1333C8BB9B7F58A2A7DBCC0826D1034F4C2D5F5029B504AEEDA11A40B24CEA0A
Malicious:	false
Reputation:	low
Preview:	/tmp/3M2y5KkOrL.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.99262311509411
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	3M2y5KkOrL.elf
File size:	184'870 bytes
MD5:	76049a7d151826aab9677963c6fc4078
SHA1:	23d1b86af70ea679b57f37f8cf0cfd898f0d9e5b
SHA256:	9a25096189da8348242bbbfd61a94d03864abe3b9b85d572f2f6d661a48bfd19
SHA512:	d2c2ba062301778d411b1656f2cb50ebd60348224673572d2c2aec8d1ca979c94167d9069c530bb94f11435c1acfb1fa0f20de4fb0dafda7481a19bdddd50ec2
SSDEEP:	3072:5UStdNbma1W9YHk9ah/QqXFgwakY7mo6xx/YpEoGM/RhkwLTNN:qSnNT1W6E9ah/Qq1gB2okx/yJGM/Rhku
TLSH:	72042A45EA404B13C0D72BB9F6DF42453323A7A497EB73069528AFF43F8679E4E22905
File Content Preview:	.ELF..............(.........4..../......4. ...(........pp...p%..p%..p...p................................................................V..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	143288
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17f9c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x2008c	0x1808c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x200a0	0x180a0	0x24b8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x22558	0x1a558	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x22570	0x1a570	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2a6e0	0x1a6e0	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2a6e4	0x1a6e4	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2a6e8	0x1a6e8	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2a6e8	0x1a6e8	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2a6ec	0x1a6ec	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2a6f0	0x1a6f0	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2a6f4	0x1a6f4	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2a7b4	0x1a7b4	0x2f4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2aaa8	0x1aaa8	0x5304	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1aaa8	0xea4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1b950	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1bab0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1bcee	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1e6cd	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1f053	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x20130	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2046c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x20f28	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x22752	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x22e82	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x22e98	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x23468	0x6570	0x10	0x0		29	937	4
.strtab	STRTAB	0x0	0x299d8	0x384e	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1a570	0x22570	0x22570	0x170	0x170	4.6806	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1a6e0	0x1a6e0	6.1424	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1a6e0	0x2a6e0	0x2a6e0	0x3c8	0x56cc	4.2743	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1a6e4	0x2a6e4	0x2a6e4	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:47:22.007647038 CEST	48202	443	192.168.2.13	185.125.190.26
Apr 19, 2024 11:47:53.239732981 CEST	48202	443	192.168.2.13	185.125.190.26

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:47:11.710575104 CEST	40443	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:11.830743074 CEST	53	40443	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:11.831064939 CEST	41681	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:11.951822996 CEST	53	41681	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:11.951987982 CEST	34064	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:12.072413921 CEST	53	34064	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:12.072570086 CEST	56394	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:12.192744017 CEST	53	56394	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:12.192904949 CEST	53663	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:12.298091888 CEST	53	53663	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:16.298971891 CEST	43634	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:16.420958996 CEST	53	43634	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:16.421133041 CEST	59671	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:16.526102066 CEST	53	59671	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:16.526261091 CEST	47000	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:16.646203995 CEST	53	47000	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:16.646395922 CEST	39515	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:16.751390934 CEST	53	39515	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:16.751507998 CEST	49486	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:16.856535912 CEST	53	49486	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:19.857009888 CEST	58802	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:19.962485075 CEST	53	58802	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:19.962769032 CEST	44592	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:20.067920923 CEST	53	44592	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:20.068125963 CEST	59873	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:20.173155069 CEST	53	59873	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:20.173326969 CEST	58594	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:20.278570890 CEST	53	58594	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:20.278831959 CEST	43204	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:20.384653091 CEST	53	43204	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:21.384998083 CEST	55828	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:21.490202904 CEST	53	55828	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:21.490443945 CEST	37025	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:21.595418930 CEST	53	37025	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:21.595587969 CEST	55078	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:21.700650930 CEST	53	55078	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:21.700819969 CEST	40290	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:21.806186914 CEST	53	40290	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:21.806355000 CEST	52101	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:21.911290884 CEST	53	52101	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:25.911837101 CEST	54165	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:26.016789913 CEST	53	54165	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:26.016908884 CEST	52063	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:26.122291088 CEST	53	52063	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:26.122395992 CEST	38439	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:26.227703094 CEST	53	38439	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:26.227807045 CEST	43163	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:26.332535028 CEST	53	43163	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:26.332634926 CEST	51276	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:26.437655926 CEST	53	51276	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:31.438024044 CEST	43369	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:31.543395042 CEST	53	43369	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:31.543530941 CEST	44831	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:31.648072004 CEST	53	44831	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:31.648185968 CEST	48210	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:31.753046989 CEST	53	48210	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:31.753189087 CEST	59438	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:31.858408928 CEST	53	59438	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:31.858571053 CEST	39062	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:31.964148998 CEST	53	39062	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:36.964435101 CEST	45828	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:37.069417953 CEST	53	45828	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:37.069545031 CEST	48220	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:37.175862074 CEST	53	48220	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:37.175982952 CEST	33328	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:37.282516003 CEST	53	33328	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:37.282656908 CEST	40061	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:37.392194986 CEST	53	40061	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:37.392321110 CEST	50585	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:37.497416019 CEST	53	50585	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:39.497730017 CEST	47665	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:39.602802038 CEST	53	47665	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:39.602948904 CEST	56662	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:39.707729101 CEST	53	56662	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:39.707956076 CEST	48752	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:39.813102961 CEST	53	48752	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:39.813199043 CEST	47463	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:39.918322086 CEST	53	47463	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:39.918426991 CEST	44611	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:40.023643017 CEST	53	44611	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:42.023964882 CEST	51122	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:42.128968000 CEST	53	51122	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:42.129117966 CEST	50416	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:42.233803034 CEST	53	50416	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:42.233913898 CEST	55067	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:42.338975906 CEST	53	55067	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:42.339076996 CEST	43474	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:42.444031954 CEST	53	43474	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:42.444120884 CEST	37665	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:42.548657894 CEST	53	37665	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:44.549056053 CEST	58377	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:44.654184103 CEST	53	58377	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:44.654340982 CEST	39197	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:44.759479046 CEST	53	39197	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:44.759610891 CEST	47527	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:44.864269018 CEST	53	47527	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:44.864419937 CEST	39762	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:44.969249964 CEST	53	39762	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:44.969422102 CEST	39820	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:45.074109077 CEST	53	39820	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:48.074641943 CEST	50319	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:48.179768085 CEST	53	50319	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:48.179980040 CEST	48528	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:48.285238981 CEST	53	48528	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:48.285521030 CEST	41844	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:48.390523911 CEST	53	41844	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:48.390784025 CEST	35518	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:48.495711088 CEST	53	35518	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:48.495970964 CEST	41600	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:48.600574017 CEST	53	41600	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:52.601058960 CEST	35847	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:52.706760883 CEST	53	35847	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:52.707043886 CEST	39244	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:52.812592030 CEST	53	39244	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:52.812863111 CEST	59700	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:52.921915054 CEST	53	59700	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:52.922152042 CEST	59420	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:53.027739048 CEST	53	59420	8.8.8.8	192.168.2.13
Apr 19, 2024 11:47:53.027864933 CEST	35881	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:47:53.135024071 CEST	53	35881	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:00.135571957 CEST	43083	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:00.241343021 CEST	53	43083	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:00.241528034 CEST	53867	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:00.346210957 CEST	53	53867	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:00.346389055 CEST	59750	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:00.451648951 CEST	53	59750	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:00.451915979 CEST	36078	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:00.557467937 CEST	53	36078	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:00.557627916 CEST	44259	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:00.663033009 CEST	53	44259	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:10.663695097 CEST	53237	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:10.769087076 CEST	53	53237	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:10.769375086 CEST	47922	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:10.874852896 CEST	53	47922	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:10.875082016 CEST	53046	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:10.980173111 CEST	53	53046	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:10.980477095 CEST	37918	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:11.085757971 CEST	53	37918	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:11.086078882 CEST	57772	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:11.191220999 CEST	53	57772	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:18.191643953 CEST	52946	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:18.297055960 CEST	53	52946	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:18.297303915 CEST	47169	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:18.402884007 CEST	53	47169	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:18.403017044 CEST	32882	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:18.508147001 CEST	53	32882	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:18.508419037 CEST	51123	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:18.613605022 CEST	53	51123	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:18.613785028 CEST	45804	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:18.719197989 CEST	53	45804	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:26.720154047 CEST	59961	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:26.826107025 CEST	53	59961	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:26.826813936 CEST	42838	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:26.931986094 CEST	53	42838	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:26.932284117 CEST	48417	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:27.037986040 CEST	53	48417	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:27.038258076 CEST	38886	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:27.143687963 CEST	53	38886	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:27.143882990 CEST	40919	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:27.248791933 CEST	53	40919	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:35.249383926 CEST	40414	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:35.354657888 CEST	53	40414	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:35.354952097 CEST	40458	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:35.460289001 CEST	53	40458	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:35.460479021 CEST	35613	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:35.566107035 CEST	53	35613	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:35.566412926 CEST	51663	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:35.671776056 CEST	53	51663	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:35.672085047 CEST	46110	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:35.777654886 CEST	53	46110	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:37.778096914 CEST	38198	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:37.883481979 CEST	53	38198	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:37.883738041 CEST	55783	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:37.988991022 CEST	53	55783	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:37.989298105 CEST	34411	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:38.094832897 CEST	53	34411	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:38.095042944 CEST	46791	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:38.200808048 CEST	53	46791	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:38.201112986 CEST	38720	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:38.306236029 CEST	53	38720	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:41.306698084 CEST	42435	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:41.412306070 CEST	53	42435	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:41.412584066 CEST	41177	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:41.517971039 CEST	53	41177	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:41.518152952 CEST	57968	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:41.623274088 CEST	53	57968	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:41.623517036 CEST	42832	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:41.728662968 CEST	53	42832	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:41.728996038 CEST	33480	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:41.834686995 CEST	53	33480	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:44.835459948 CEST	57771	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:44.941050053 CEST	53	57771	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:44.941414118 CEST	32782	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:45.047223091 CEST	53	32782	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:45.047756910 CEST	36883	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:45.153033018 CEST	53	36883	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:45.153264046 CEST	35609	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:45.258718967 CEST	53	35609	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:45.258903027 CEST	60168	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:45.363929033 CEST	53	60168	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:50.364403963 CEST	58192	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:50.470041990 CEST	53	58192	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:50.470520020 CEST	55179	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:50.575778961 CEST	53	55179	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:50.576106071 CEST	51848	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:50.681297064 CEST	53	51848	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:50.681639910 CEST	50109	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:50.786783934 CEST	53	50109	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:50.787035942 CEST	38284	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:50.892759085 CEST	53	38284	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:53.893498898 CEST	41617	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:53.998488903 CEST	53	41617	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:53.998723984 CEST	41945	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:54.103470087 CEST	53	41945	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:54.103740931 CEST	33814	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:54.209192991 CEST	53	33814	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:54.209425926 CEST	50752	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:54.314569950 CEST	53	50752	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:54.314760923 CEST	43997	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:54.419651985 CEST	53	43997	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:57.420397997 CEST	47006	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:57.525969028 CEST	53	47006	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:57.526292086 CEST	58627	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:57.631607056 CEST	53	58627	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:57.631830931 CEST	42964	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:57.737149954 CEST	53	42964	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:57.737273932 CEST	39777	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:57.842561007 CEST	53	39777	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:57.842689037 CEST	54168	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:48:57.950395107 CEST	53	54168	8.8.8.8	192.168.2.13
Apr 19, 2024 11:48:59.951035976 CEST	49194	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:00.056546926 CEST	53	49194	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:00.056817055 CEST	51318	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:00.161689997 CEST	53	51318	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:00.161890984 CEST	54345	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:00.267069101 CEST	53	54345	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:00.267250061 CEST	39568	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:00.372282982 CEST	53	39568	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:00.372468948 CEST	56216	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:00.478022099 CEST	53	56216	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:01.478756905 CEST	59957	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:01.584225893 CEST	53	59957	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:01.584502935 CEST	48259	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:01.689626932 CEST	53	48259	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:01.689769983 CEST	38398	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:01.795214891 CEST	53	38398	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:01.795357943 CEST	54233	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:01.900600910 CEST	53	54233	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:01.900743008 CEST	49271	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:02.006278992 CEST	53	49271	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:04.006722927 CEST	38130	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:04.112236977 CEST	53	38130	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:04.112452984 CEST	60557	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:04.218214989 CEST	53	60557	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:04.218406916 CEST	35189	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:04.323832989 CEST	53	35189	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:04.324007988 CEST	38439	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:04.429822922 CEST	53	38439	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:04.429996014 CEST	35268	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:04.535202980 CEST	53	35268	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:14.535635948 CEST	44553	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:14.641001940 CEST	53	44553	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:14.641315937 CEST	46879	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:14.746448040 CEST	53	46879	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:14.746622086 CEST	37312	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:14.851790905 CEST	53	37312	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:14.851967096 CEST	50653	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:14.956860065 CEST	53	50653	8.8.8.8	192.168.2.13
Apr 19, 2024 11:49:14.957077980 CEST	35829	53	192.168.2.13	8.8.8.8
Apr 19, 2024 11:49:15.065891981 CEST	53	35829	8.8.8.8	192.168.2.13

Start time (UTC):	09:47:10
Start date (UTC):	19/04/2024
Path:	/tmp/3M2y5KkOrL.elf
Arguments:	/tmp/3M2y5KkOrL.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 3M2y5KkOrL.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.03mU3M (deleted)

/tmp/qemu-open.061O1M (deleted)

/tmp/qemu-open.09ZLLM (deleted)

/tmp/qemu-open.0B5WrL (deleted)

/tmp/qemu-open.0CvPiN (deleted)

/tmp/qemu-open.0DujmK (deleted)

/tmp/qemu-open.0N73YL (deleted)

/tmp/qemu-open.0UjO9I (deleted)

/tmp/qemu-open.0W5d4L (deleted)

/tmp/qemu-open.0csqDK (deleted)

/tmp/qemu-open.0hfVQM (deleted)

/tmp/qemu-open.0pzfvL (deleted)

/tmp/qemu-open.0q9HwJ (deleted)

/tmp/qemu-open.0s7yKL (deleted)

/tmp/qemu-open.114zYL (deleted)

/tmp/qemu-open.153zWK (deleted)

/tmp/qemu-open.175B8K (deleted)

/tmp/qemu-open.19hWpJ (deleted)

/tmp/qemu-open.1BlZXK (deleted)

/tmp/qemu-open.1E34DK (deleted)

/tmp/qemu-open.1PhP4J (deleted)

/tmp/qemu-open.1RI8aJ (deleted)

/tmp/qemu-open.1dvLhK (deleted)

/tmp/qemu-open.1fvMmJ (deleted)

/tmp/qemu-open.1lCg5L (deleted)

/tmp/qemu-open.1lV8JM (deleted)

/tmp/qemu-open.1nUJQJ (deleted)

/tmp/qemu-open.1qC5II (deleted)

/tmp/qemu-open.24OqlM (deleted)

/tmp/qemu-open.26S3NM (deleted)

Linux Analysis Report
3M2y5KkOrL.elf

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre