Edit tour

Linux Analysis Report
5Jc3rTI2h9.elf

Overview

General Information

Sample name:	5Jc3rTI2h9.elf renamed because original name is a hash value
Original sample name:	a457e8bec7cbd9210a688eef3889d640.elf
Analysis ID:	1430968
MD5:	a457e8bec7cbd9210a688eef3889d640
SHA1:	5c37287bb0da4717d63c44984912db9252ae3a5a
SHA256:	b6434db457e493b4030c1c610af544cc9f4dcede9e3de2846d56f51e06e59b31
Tags:	64elfmirai
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Machine Learning detection for sample

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Yara signature match

Classification

Analysis Advice

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430968
Start date and time:	2024-04-24 12:37:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	5Jc3rTI2h9.elf renamed because original name is a hash value
Original Sample Name:	a457e8bec7cbd9210a688eef3889d640.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/0@95/0

Runtime Messages

Command:	/tmp/5Jc3rTI2h9.elf
PID:	5428
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

5Jc3rTI2h9.elf (PID: 5428, Parent: 5352, MD5: a457e8bec7cbd9210a688eef3889d640) Arguments: /tmp/5Jc3rTI2h9.elf

5Jc3rTI2h9.elf New Fork (PID: 5429, Parent: 5428)

5Jc3rTI2h9.elf New Fork (PID: 5430, Parent: 5429)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5Jc3rTI2h9.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5Jc3rTI2h9.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5Jc3rTI2h9.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1750c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1755c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xd9e0:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe1af:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17360:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xacd6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x100c0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x10dbe:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x16336:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xdd6f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x14356:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe03a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5Jc3rTI2h9.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1454f:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5Jc3rTI2h9.elf	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0x1e78:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
5Jc3rTI2h9.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x4ea:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5Jc3rTI2h9.elf	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x5a5f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5Jc3rTI2h9.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x5ed:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5Jc3rTI2h9.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4432:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 14 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5428.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5428.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5428.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1750c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1755c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xd9e0:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe1af:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17360:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xacd6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x100c0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x10dbe:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x16336:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xdd6f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x14356:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe03a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1454f:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0x1e78:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x4ea:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x5a5f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x5ed:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4432:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: 5Jc3rTI2h9.elf PID: 5428	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 5Jc3rTI2h9.elf PID: 5428	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 5Jc3rTI2h9.elf PID: 5428	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 5Jc3rTI2h9.elf PID: 5428	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xb5c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 18 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5Jc3rTI2h9.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: 5Jc3rTI2h9.elf	ReversingLabs: Detection: 52%
Source: 5Jc3rTI2h9.elf	Virustotal: Detection: 43%			Perma Link

Machine Learning detection for sample

Source: 5Jc3rTI2h9.elf

Joe Sandbox ML: detected

Source: 5Jc3rTI2h9.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: unknown

DNS traffic detected: query: rVgserver.ddns replaycode: Name error (3)

Source: unknown

DNS traffic detected: queries for: rVgserver.ddns

System Summary

Malicious sample detected (through community Yara rule)

Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5Jc3rTI2h9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.troj.linELF@0/0@95/0

Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/5271/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/5Jc3rTI2h9.elf (PID: 5430)	File opened: /proc/35/cmdline	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5Jc3rTI2h9.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: 5Jc3rTI2h9.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5Jc3rTI2h9.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: 5Jc3rTI2h9.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5Jc3rTI2h9.elf PID: 5428, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5Jc3rTI2h9.elf	53%	ReversingLabs	Linux.Trojan.Mirai
5Jc3rTI2h9.elf	43%	Virustotal		Browse
5Jc3rTI2h9.elf	100%	Avira	EXP/ELF.Mirai.Z.A
5Jc3rTI2h9.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rVgserver.ddns	unknown	unknown	true		unknown

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.28516570062648
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	5Jc3rTI2h9.elf
File size:	143'832 bytes
MD5:	a457e8bec7cbd9210a688eef3889d640
SHA1:	5c37287bb0da4717d63c44984912db9252ae3a5a
SHA256:	b6434db457e493b4030c1c610af544cc9f4dcede9e3de2846d56f51e06e59b31
SHA512:	ffbcc830e16cc12ee5d3af8456f064ed228246e992400ef231b3d0320441134cd4aca3b86426a8dafe07faaec4ddb36952702cb4b0bab5fab48cb90599d313ff
SSDEEP:	3072:mTUTfCdO6FFtoqH6EwKhc/t/ekNaogMewcgsK027uPOlL:mTUTfCdO6FFtoqowwQdAL
TLSH:	72E34B07B4C184FDC4DAC1B44B9FF53AED32B0AD1238B16B27D4AE222E59E205F1DA54
File Content Preview:	.ELF..............>.......@.....@.......X/..........@.8...@.......................@.......@...............................................Q.......Q.....p.......................Q.td....................................................H...._....zk..H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	143192
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x16ba6	0x0	0x6	AX	16
.fini	PROGBITS	0x416ca6	0x16ca6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x416cc0	0x16cc0	0x33e0	0x0	0x2	A	32
.ctors	PROGBITS	0x51a0a8	0x1a0a8	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x51a0c0	0x1a0c0	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x51a0e0	0x1a0e0	0x8e38	0x0	0x3	WA	32
.bss	NOBITS	0x522f20	0x22f18	0x72a0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x22f18	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1a0a0	0x1a0a0	6.4197	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x1a0a8	0x51a0a8	0x51a0a8	0x8e70	0x10118	0.2280	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:38:05.485233068 CEST	58122	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:05.654951096 CEST	53	58122	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:05.655042887 CEST	34689	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:05.825977087 CEST	53	34689	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:05.826097965 CEST	45779	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:05.996026039 CEST	53	45779	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:05.996213913 CEST	48726	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:06.166995049 CEST	53	48726	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:06.167150021 CEST	37951	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:06.337182999 CEST	53	37951	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:15.337506056 CEST	58883	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:15.507556915 CEST	53	58883	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:15.507730007 CEST	57663	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:15.678471088 CEST	53	57663	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:15.678630114 CEST	37108	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:15.849689007 CEST	53	37108	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:15.849809885 CEST	32926	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:16.019658089 CEST	53	32926	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:16.019846916 CEST	46905	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:16.191910982 CEST	53	46905	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:17.192265034 CEST	39320	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:17.362183094 CEST	53	39320	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:17.362376928 CEST	35299	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:17.532162905 CEST	53	35299	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:17.532392979 CEST	50620	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:17.703270912 CEST	53	50620	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:17.703433990 CEST	54536	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:17.873197079 CEST	53	54536	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:17.873384953 CEST	48930	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:18.043704987 CEST	53	48930	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:23.044053078 CEST	33512	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:23.214004993 CEST	53	33512	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:23.214278936 CEST	53704	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:23.384181023 CEST	53	53704	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:23.384427071 CEST	35909	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:23.554198027 CEST	53	35909	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:23.554392099 CEST	33346	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:23.724531889 CEST	53	33346	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:23.724761009 CEST	59809	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:23.894659042 CEST	53	59809	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:33.895111084 CEST	53136	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:34.064948082 CEST	53	53136	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:34.065176964 CEST	46567	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:34.235323906 CEST	53	46567	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:34.235635042 CEST	40818	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:34.405891895 CEST	53	40818	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:34.406246901 CEST	41708	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:34.576316118 CEST	53	41708	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:34.576503038 CEST	35646	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:34.747759104 CEST	53	35646	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:41.748277903 CEST	52382	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:41.918018103 CEST	53	52382	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:41.918267012 CEST	57870	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:42.088987112 CEST	53	57870	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:42.089186907 CEST	52011	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:42.259947062 CEST	53	52011	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:42.260128975 CEST	39121	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:42.429977894 CEST	53	39121	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:42.430128098 CEST	57670	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:42.599915028 CEST	53	57670	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:51.600322962 CEST	48335	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:51.770246983 CEST	53	48335	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:51.770400047 CEST	60504	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:51.940450907 CEST	53	60504	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:51.940685034 CEST	45211	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:52.111157894 CEST	53	45211	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:52.111331940 CEST	51648	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:52.281100035 CEST	53	51648	8.8.8.8	192.168.2.13
Apr 24, 2024 12:38:52.281431913 CEST	37209	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:38:52.451426983 CEST	53	37209	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:02.451953888 CEST	50413	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:02.622807026 CEST	53	50413	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:02.622925997 CEST	40997	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:02.797998905 CEST	53	40997	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:02.798286915 CEST	34898	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:02.969264984 CEST	53	34898	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:02.969460011 CEST	42752	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:03.139055967 CEST	53	42752	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:03.139359951 CEST	37359	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:03.310380936 CEST	53	37359	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:04.310852051 CEST	38765	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:04.481848001 CEST	53	38765	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:04.481964111 CEST	39802	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:04.652667046 CEST	53	39802	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:04.652815104 CEST	56147	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:04.824001074 CEST	53	56147	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:04.824117899 CEST	49101	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:04.994050026 CEST	53	49101	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:04.994142056 CEST	39848	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:05.164114952 CEST	53	39848	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:14.164386988 CEST	42567	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:14.335133076 CEST	53	42567	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:14.335258961 CEST	55738	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:14.505271912 CEST	53	55738	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:14.505384922 CEST	54367	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:14.675529003 CEST	53	54367	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:14.675685883 CEST	50473	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:14.846458912 CEST	53	50473	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:14.846587896 CEST	43398	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:15.016205072 CEST	53	43398	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:24.016635895 CEST	38521	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:24.187704086 CEST	53	38521	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:24.187941074 CEST	46311	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:24.358882904 CEST	53	46311	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:24.359199047 CEST	52821	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:24.529136896 CEST	53	52821	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:24.529335022 CEST	45695	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:24.700131893 CEST	53	45695	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:24.700340986 CEST	57235	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:24.870482922 CEST	53	57235	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:25.870987892 CEST	53769	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:26.040941000 CEST	53	53769	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:26.041155100 CEST	33545	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:26.211275101 CEST	53	33545	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:26.211622953 CEST	57820	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:26.381529093 CEST	53	57820	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:26.381701946 CEST	38530	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:26.551558018 CEST	53	38530	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:26.551733971 CEST	49863	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:26.721563101 CEST	53	49863	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:28.722037077 CEST	36951	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:28.893692017 CEST	53	36951	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:28.893908978 CEST	60855	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:29.063927889 CEST	53	60855	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:29.064096928 CEST	47173	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:29.233870029 CEST	53	47173	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:29.234056950 CEST	35753	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:29.403994083 CEST	53	35753	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:29.404186964 CEST	53254	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:29.573980093 CEST	53	53254	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:34.574362993 CEST	44883	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:34.744601011 CEST	53	44883	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:34.744784117 CEST	35545	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:34.915054083 CEST	53	35545	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:34.915209055 CEST	49623	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:35.086242914 CEST	53	49623	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:35.086456060 CEST	51659	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:35.257318020 CEST	53	51659	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:35.257488966 CEST	33425	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:35.428368092 CEST	53	33425	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:36.428714991 CEST	46553	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:36.598670959 CEST	53	46553	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:36.598840952 CEST	56326	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:36.768762112 CEST	53	56326	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:36.768949032 CEST	32940	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:36.939131975 CEST	53	32940	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:36.939340115 CEST	49694	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:37.109117031 CEST	53	49694	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:37.109316111 CEST	37062	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:37.280551910 CEST	53	37062	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:47.280936003 CEST	35182	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:47.451071978 CEST	53	35182	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:47.451359987 CEST	42457	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:47.632484913 CEST	53	42457	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:47.632848024 CEST	33442	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:47.803689003 CEST	53	33442	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:47.803812027 CEST	53415	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:47.974942923 CEST	53	53415	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:47.975094080 CEST	49829	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:48.144932032 CEST	53	49829	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:55.145390987 CEST	56314	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:55.317482948 CEST	53	56314	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:55.317642927 CEST	56271	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:55.487394094 CEST	53	56271	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:55.487510920 CEST	57469	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:55.658365011 CEST	53	57469	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:55.658628941 CEST	36903	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:55.829363108 CEST	53	36903	8.8.8.8	192.168.2.13
Apr 24, 2024 12:39:55.829598904 CEST	46078	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:39:55.999814987 CEST	53	46078	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:05.000205994 CEST	33493	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:05.170063972 CEST	53	33493	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:05.170260906 CEST	45205	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:05.340105057 CEST	53	45205	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:05.340586901 CEST	40338	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:05.510343075 CEST	53	40338	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:05.510689020 CEST	36918	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:05.680454969 CEST	53	36918	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:05.680913925 CEST	58318	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:05.850667000 CEST	53	58318	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:09.851011992 CEST	49260	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:10.021372080 CEST	53	49260	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:10.021539927 CEST	58270	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:10.191077948 CEST	53	58270	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:10.191252947 CEST	45361	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:10.361008883 CEST	53	45361	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:10.361161947 CEST	39282	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:10.530864954 CEST	53	39282	8.8.8.8	192.168.2.13
Apr 24, 2024 12:40:10.530999899 CEST	58596	53	192.168.2.13	8.8.8.8
Apr 24, 2024 12:40:10.701656103 CEST	53	58596	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 12:38:05.485233068 CEST	192.168.2.13	8.8.8.8	0x42a8	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:05.655042887 CEST	192.168.2.13	8.8.8.8	0x42a8	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:05.826097965 CEST	192.168.2.13	8.8.8.8	0x42a8	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:05.996213913 CEST	192.168.2.13	8.8.8.8	0x42a8	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:06.167150021 CEST	192.168.2.13	8.8.8.8	0x42a8	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.337506056 CEST	192.168.2.13	8.8.8.8	0x118	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.507730007 CEST	192.168.2.13	8.8.8.8	0x118	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.678630114 CEST	192.168.2.13	8.8.8.8	0x118	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.849809885 CEST	192.168.2.13	8.8.8.8	0x118	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:16.019846916 CEST	192.168.2.13	8.8.8.8	0x118	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.192265034 CEST	192.168.2.13	8.8.8.8	0xbf3f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.362376928 CEST	192.168.2.13	8.8.8.8	0xbf3f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.532392979 CEST	192.168.2.13	8.8.8.8	0xbf3f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.703433990 CEST	192.168.2.13	8.8.8.8	0xbf3f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.873384953 CEST	192.168.2.13	8.8.8.8	0xbf3f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.044053078 CEST	192.168.2.13	8.8.8.8	0x93b7	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.214278936 CEST	192.168.2.13	8.8.8.8	0x93b7	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.384427071 CEST	192.168.2.13	8.8.8.8	0x93b7	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.554392099 CEST	192.168.2.13	8.8.8.8	0x93b7	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.724761009 CEST	192.168.2.13	8.8.8.8	0x93b7	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:33.895111084 CEST	192.168.2.13	8.8.8.8	0x11fc	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.065176964 CEST	192.168.2.13	8.8.8.8	0x11fc	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.235635042 CEST	192.168.2.13	8.8.8.8	0x11fc	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.406246901 CEST	192.168.2.13	8.8.8.8	0x11fc	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.576503038 CEST	192.168.2.13	8.8.8.8	0x11fc	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:41.748277903 CEST	192.168.2.13	8.8.8.8	0x6d2e	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:41.918267012 CEST	192.168.2.13	8.8.8.8	0x6d2e	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.089186907 CEST	192.168.2.13	8.8.8.8	0x6d2e	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.260128975 CEST	192.168.2.13	8.8.8.8	0x6d2e	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.430128098 CEST	192.168.2.13	8.8.8.8	0x6d2e	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:51.600322962 CEST	192.168.2.13	8.8.8.8	0xfd47	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:51.770400047 CEST	192.168.2.13	8.8.8.8	0xfd47	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:51.940685034 CEST	192.168.2.13	8.8.8.8	0xfd47	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:52.111331940 CEST	192.168.2.13	8.8.8.8	0xfd47	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:52.281431913 CEST	192.168.2.13	8.8.8.8	0xfd47	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.451953888 CEST	192.168.2.13	8.8.8.8	0x9d7f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.622925997 CEST	192.168.2.13	8.8.8.8	0x9d7f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.798286915 CEST	192.168.2.13	8.8.8.8	0x9d7f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.969460011 CEST	192.168.2.13	8.8.8.8	0x9d7f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:03.139359951 CEST	192.168.2.13	8.8.8.8	0x9d7f	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.310852051 CEST	192.168.2.13	8.8.8.8	0x6eb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.481964111 CEST	192.168.2.13	8.8.8.8	0x6eb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.652815104 CEST	192.168.2.13	8.8.8.8	0x6eb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.824117899 CEST	192.168.2.13	8.8.8.8	0x6eb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.994142056 CEST	192.168.2.13	8.8.8.8	0x6eb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.164386988 CEST	192.168.2.13	8.8.8.8	0x9b44	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.335258961 CEST	192.168.2.13	8.8.8.8	0x9b44	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.505384922 CEST	192.168.2.13	8.8.8.8	0x9b44	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.675685883 CEST	192.168.2.13	8.8.8.8	0x9b44	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.846587896 CEST	192.168.2.13	8.8.8.8	0x9b44	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.016635895 CEST	192.168.2.13	8.8.8.8	0x65aa	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.187941074 CEST	192.168.2.13	8.8.8.8	0x65aa	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.359199047 CEST	192.168.2.13	8.8.8.8	0x65aa	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.529335022 CEST	192.168.2.13	8.8.8.8	0x65aa	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.700340986 CEST	192.168.2.13	8.8.8.8	0x65aa	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:25.870987892 CEST	192.168.2.13	8.8.8.8	0x1fdb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.041155100 CEST	192.168.2.13	8.8.8.8	0x1fdb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.211622953 CEST	192.168.2.13	8.8.8.8	0x1fdb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.381701946 CEST	192.168.2.13	8.8.8.8	0x1fdb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.551733971 CEST	192.168.2.13	8.8.8.8	0x1fdb	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:28.722037077 CEST	192.168.2.13	8.8.8.8	0xe85c	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:28.893908978 CEST	192.168.2.13	8.8.8.8	0xe85c	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.064096928 CEST	192.168.2.13	8.8.8.8	0xe85c	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.234056950 CEST	192.168.2.13	8.8.8.8	0xe85c	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.404186964 CEST	192.168.2.13	8.8.8.8	0xe85c	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:34.574362993 CEST	192.168.2.13	8.8.8.8	0x4616	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:34.744784117 CEST	192.168.2.13	8.8.8.8	0x4616	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:34.915209055 CEST	192.168.2.13	8.8.8.8	0x4616	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:35.086456060 CEST	192.168.2.13	8.8.8.8	0x4616	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:35.257488966 CEST	192.168.2.13	8.8.8.8	0x4616	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.428714991 CEST	192.168.2.13	8.8.8.8	0x2918	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.598840952 CEST	192.168.2.13	8.8.8.8	0x2918	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.768949032 CEST	192.168.2.13	8.8.8.8	0x2918	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.939340115 CEST	192.168.2.13	8.8.8.8	0x2918	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:37.109316111 CEST	192.168.2.13	8.8.8.8	0x2918	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.280936003 CEST	192.168.2.13	8.8.8.8	0xc835	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.451359987 CEST	192.168.2.13	8.8.8.8	0xc835	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.632848024 CEST	192.168.2.13	8.8.8.8	0xc835	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.803812027 CEST	192.168.2.13	8.8.8.8	0xc835	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.975094080 CEST	192.168.2.13	8.8.8.8	0xc835	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.145390987 CEST	192.168.2.13	8.8.8.8	0x314a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.317642927 CEST	192.168.2.13	8.8.8.8	0x314a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.487510920 CEST	192.168.2.13	8.8.8.8	0x314a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.658628941 CEST	192.168.2.13	8.8.8.8	0x314a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.829598904 CEST	192.168.2.13	8.8.8.8	0x314a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.000205994 CEST	192.168.2.13	8.8.8.8	0x5b9a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.170260906 CEST	192.168.2.13	8.8.8.8	0x5b9a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.340586901 CEST	192.168.2.13	8.8.8.8	0x5b9a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.510689020 CEST	192.168.2.13	8.8.8.8	0x5b9a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.680913925 CEST	192.168.2.13	8.8.8.8	0x5b9a	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:09.851011992 CEST	192.168.2.13	8.8.8.8	0x8391	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.021539927 CEST	192.168.2.13	8.8.8.8	0x8391	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.191252947 CEST	192.168.2.13	8.8.8.8	0x8391	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.361161947 CEST	192.168.2.13	8.8.8.8	0x8391	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.530999899 CEST	192.168.2.13	8.8.8.8	0x8391	Standard query (0)	rVgserver.ddns	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 12:38:05.654951096 CEST	8.8.8.8	192.168.2.13	0x42a8	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:05.825977087 CEST	8.8.8.8	192.168.2.13	0x42a8	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:05.996026039 CEST	8.8.8.8	192.168.2.13	0x42a8	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:06.166995049 CEST	8.8.8.8	192.168.2.13	0x42a8	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:06.337182999 CEST	8.8.8.8	192.168.2.13	0x42a8	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.507556915 CEST	8.8.8.8	192.168.2.13	0x118	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.678471088 CEST	8.8.8.8	192.168.2.13	0x118	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:15.849689007 CEST	8.8.8.8	192.168.2.13	0x118	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:16.019658089 CEST	8.8.8.8	192.168.2.13	0x118	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:16.191910982 CEST	8.8.8.8	192.168.2.13	0x118	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.362183094 CEST	8.8.8.8	192.168.2.13	0xbf3f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.532162905 CEST	8.8.8.8	192.168.2.13	0xbf3f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.703270912 CEST	8.8.8.8	192.168.2.13	0xbf3f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:17.873197079 CEST	8.8.8.8	192.168.2.13	0xbf3f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:18.043704987 CEST	8.8.8.8	192.168.2.13	0xbf3f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.214004993 CEST	8.8.8.8	192.168.2.13	0x93b7	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.384181023 CEST	8.8.8.8	192.168.2.13	0x93b7	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.554198027 CEST	8.8.8.8	192.168.2.13	0x93b7	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.724531889 CEST	8.8.8.8	192.168.2.13	0x93b7	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:23.894659042 CEST	8.8.8.8	192.168.2.13	0x93b7	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.064948082 CEST	8.8.8.8	192.168.2.13	0x11fc	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.235323906 CEST	8.8.8.8	192.168.2.13	0x11fc	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.405891895 CEST	8.8.8.8	192.168.2.13	0x11fc	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.576316118 CEST	8.8.8.8	192.168.2.13	0x11fc	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:34.747759104 CEST	8.8.8.8	192.168.2.13	0x11fc	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:41.918018103 CEST	8.8.8.8	192.168.2.13	0x6d2e	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.088987112 CEST	8.8.8.8	192.168.2.13	0x6d2e	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.259947062 CEST	8.8.8.8	192.168.2.13	0x6d2e	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.429977894 CEST	8.8.8.8	192.168.2.13	0x6d2e	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:42.599915028 CEST	8.8.8.8	192.168.2.13	0x6d2e	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:51.770246983 CEST	8.8.8.8	192.168.2.13	0xfd47	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:51.940450907 CEST	8.8.8.8	192.168.2.13	0xfd47	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:52.111157894 CEST	8.8.8.8	192.168.2.13	0xfd47	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:52.281100035 CEST	8.8.8.8	192.168.2.13	0xfd47	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:38:52.451426983 CEST	8.8.8.8	192.168.2.13	0xfd47	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.622807026 CEST	8.8.8.8	192.168.2.13	0x9d7f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.797998905 CEST	8.8.8.8	192.168.2.13	0x9d7f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:02.969264984 CEST	8.8.8.8	192.168.2.13	0x9d7f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:03.139055967 CEST	8.8.8.8	192.168.2.13	0x9d7f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:03.310380936 CEST	8.8.8.8	192.168.2.13	0x9d7f	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.481848001 CEST	8.8.8.8	192.168.2.13	0x6eb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.652667046 CEST	8.8.8.8	192.168.2.13	0x6eb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.824001074 CEST	8.8.8.8	192.168.2.13	0x6eb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:04.994050026 CEST	8.8.8.8	192.168.2.13	0x6eb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:05.164114952 CEST	8.8.8.8	192.168.2.13	0x6eb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.335133076 CEST	8.8.8.8	192.168.2.13	0x9b44	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.505271912 CEST	8.8.8.8	192.168.2.13	0x9b44	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.675529003 CEST	8.8.8.8	192.168.2.13	0x9b44	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:14.846458912 CEST	8.8.8.8	192.168.2.13	0x9b44	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:15.016205072 CEST	8.8.8.8	192.168.2.13	0x9b44	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.187704086 CEST	8.8.8.8	192.168.2.13	0x65aa	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.358882904 CEST	8.8.8.8	192.168.2.13	0x65aa	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.529136896 CEST	8.8.8.8	192.168.2.13	0x65aa	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.700131893 CEST	8.8.8.8	192.168.2.13	0x65aa	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:24.870482922 CEST	8.8.8.8	192.168.2.13	0x65aa	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.040941000 CEST	8.8.8.8	192.168.2.13	0x1fdb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.211275101 CEST	8.8.8.8	192.168.2.13	0x1fdb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.381529093 CEST	8.8.8.8	192.168.2.13	0x1fdb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.551558018 CEST	8.8.8.8	192.168.2.13	0x1fdb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:26.721563101 CEST	8.8.8.8	192.168.2.13	0x1fdb	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:28.893692017 CEST	8.8.8.8	192.168.2.13	0xe85c	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.063927889 CEST	8.8.8.8	192.168.2.13	0xe85c	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.233870029 CEST	8.8.8.8	192.168.2.13	0xe85c	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.403994083 CEST	8.8.8.8	192.168.2.13	0xe85c	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:29.573980093 CEST	8.8.8.8	192.168.2.13	0xe85c	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:34.744601011 CEST	8.8.8.8	192.168.2.13	0x4616	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:34.915054083 CEST	8.8.8.8	192.168.2.13	0x4616	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:35.086242914 CEST	8.8.8.8	192.168.2.13	0x4616	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:35.257318020 CEST	8.8.8.8	192.168.2.13	0x4616	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:35.428368092 CEST	8.8.8.8	192.168.2.13	0x4616	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.598670959 CEST	8.8.8.8	192.168.2.13	0x2918	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.768762112 CEST	8.8.8.8	192.168.2.13	0x2918	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:36.939131975 CEST	8.8.8.8	192.168.2.13	0x2918	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:37.109117031 CEST	8.8.8.8	192.168.2.13	0x2918	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:37.280551910 CEST	8.8.8.8	192.168.2.13	0x2918	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.451071978 CEST	8.8.8.8	192.168.2.13	0xc835	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.632484913 CEST	8.8.8.8	192.168.2.13	0xc835	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.803689003 CEST	8.8.8.8	192.168.2.13	0xc835	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:47.974942923 CEST	8.8.8.8	192.168.2.13	0xc835	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:48.144932032 CEST	8.8.8.8	192.168.2.13	0xc835	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.317482948 CEST	8.8.8.8	192.168.2.13	0x314a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.487394094 CEST	8.8.8.8	192.168.2.13	0x314a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.658365011 CEST	8.8.8.8	192.168.2.13	0x314a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.829363108 CEST	8.8.8.8	192.168.2.13	0x314a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:39:55.999814987 CEST	8.8.8.8	192.168.2.13	0x314a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.170063972 CEST	8.8.8.8	192.168.2.13	0x5b9a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.340105057 CEST	8.8.8.8	192.168.2.13	0x5b9a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.510343075 CEST	8.8.8.8	192.168.2.13	0x5b9a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.680454969 CEST	8.8.8.8	192.168.2.13	0x5b9a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:05.850667000 CEST	8.8.8.8	192.168.2.13	0x5b9a	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.021372080 CEST	8.8.8.8	192.168.2.13	0x8391	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.191077948 CEST	8.8.8.8	192.168.2.13	0x8391	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.361008883 CEST	8.8.8.8	192.168.2.13	0x8391	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.530864954 CEST	8.8.8.8	192.168.2.13	0x8391	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:40:10.701656103 CEST	8.8.8.8	192.168.2.13	0x8391	Name error (3)	rVgserver.ddns	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 5Jc3rTI2h9.elf PID: 5428, Parent PID: 5352

General

Start time (UTC):	10:38:04
Start date (UTC):	24/04/2024
Path:	/tmp/5Jc3rTI2h9.elf
Arguments:	/tmp/5Jc3rTI2h9.elf
File size:	143832 bytes
MD5 hash:	a457e8bec7cbd9210a688eef3889d640

Start time (UTC):	10:38:04
Start date (UTC):	24/04/2024
Path:	/tmp/5Jc3rTI2h9.elf
Arguments:	-
File size:	143832 bytes
MD5 hash:	a457e8bec7cbd9210a688eef3889d640

Start time (UTC):	10:38:04
Start date (UTC):	24/04/2024
Path:	/tmp/5Jc3rTI2h9.elf
Arguments:	-
File size:	143832 bytes
MD5 hash:	a457e8bec7cbd9210a688eef3889d640

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 5Jc3rTI2h9.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: 5Jc3rTI2h9.elf PID: 5428, Parent PID: 5352

General

Chronological Activities

Analysis Process: 5Jc3rTI2h9.elf PID: 5429, Parent PID: 5428

General

Chronological Activities

Analysis Process: 5Jc3rTI2h9.elf PID: 5430, Parent PID: 5429

General

Chronological Activities

Linux Analysis Report
5Jc3rTI2h9.elf